Following its global outage, CrowdStrike, the cybersecurity vendor, has published a Post Incident Review (PIR) into the incident which occurred on July 19, revealing that it was caused by a bug in its update.

The update was rolled out simultaneously across all of its systems, leading to a global outage and millions of PCs showing ” the blue screen of death”.

Planes were grounded in airports across the globe, hospitals and emergency responders lost their systems, and Sky News was off the air for several hours – with other broadcasters suffering major issues.

Microsoft was forced to take mitigation actions, and had to investigate issues across its cloud services and applications.

The company has now revealed that the entire global outage was caused by a bug in the Falcon update.

CrowdStrike said the release was a “regular part of the dynamic protection mechanisms of the Falcon platform.”

According to the release, the bug was part of a Rapid Response Content update with an undetected error, which was not picked up during stress testing due to a fault in the Content Validator.

CrowdStrike also released updates to its testing procedure to mitigate future faults.

These include adding an extra content validator, which the vendor says is already underway.

Further, for rapid response content deployment, the company says it will stagger its deployment of these updates rather than release them globally at once.

Recommended reading

• Survey: 75% of Businesses Block GenAI to Protect Data
• CrowdStrike Incident | Lessons Learned and Key Questions Answered
• Mass IT Outages Reported Worldwide

Customers will also be provided greater control over the delivery of these updates as they can select when and where these updates are deployed.

CrowdStrike aims to introduce a phased rollout using improved monitoring for both sensor and system performance. as well as providing customers release notes for update details.