Updated CrowdStrike's share price is currently tanking amid a major global IT outage its leadership has attributed to a dodgy channel file.

At the time of writing, the share price is down more than 19 percent as the security shop to some of the biggest organizations in the world continues to work through issues with its customers.

[1]

CrowdStrike shares tumble - click to enlarge

Those hoping to catch a flight today might encounter some problems as the Federal Aviation Adminstration (FAA) grounded major airlines until further notice. This includes United, Delta, and American Airlines, while Brits' go-to budget airline Ryanair is also experiencing disruption.

"Affected passengers will be notified and any passengers traveling across the network on Fri 19 July should check their Ryanair app for the latest updates on their flight," a Ryanair statement said. "We advise passengers to arrive at the airport 3 hours in advance of their flight to avoid any disruptions.

"We regret any inconvenience caused to passengers by this third-party IT issue, which is outside of Ryanair's control and affect all airlines operating across the network."

[2]

In statement sent to The Register, an FAA spokesperson said:

[3]

[4]

"The FAA continues to work closely with airlines as they work to resume normal operations. Ground stops and delays will be intermittent at various airports as the airlines work through residual technology issues. Please contact the airlines for more information and monitor [5]www.fly.faa.gov for real-time airspace updates."

From a regional perspective, Edinburgh Airport owes longer waiting times to the CrowdStrike incident, with wider reports suggesting departure boards are down across the site. Check-in services at Berlin airport are also impacted.

[6]

The list of victims is growing faster than our fingers can type. Other airports also confirmed to be affected include: Heathrow, Gatwick, Manchester, Stansted, Luton, airports across the entirety of Spain, and Swissport.

As if the UK's health service hasn't taken enough of a [7]battering in recent weeks, reports from individuals in Bristol writing into BBC Radio 4's Today program this morning, said they were unable to book doctor's appointments at their local general practitioner's (GP) office.

Putneymead GP surgery in West London has updated its website to say its core Medical Management System is affected and online requests are restricted. The phone lines are also down temporarily but the practice remains open.

[8]

Putneymead Group GP website outage message – click to enlarge

The Register asked the National Health Service (NHS) about this and in a statement it explained that IT issues have hit the EMIS system used by practices across the country.

"The NHS is aware of a global IT outage and an issue with EMIS, an appointment and patient record system, which is causing disruption in the majority of GP practices," it said.

[9]

"The NHS has longstanding measures in place to manage the disruption, including using paper patient records and handwritten prescriptions, and the usual phone systems to contact your GP.

"There is currently no known impact on 999 or emergency services, so people should use these services as they usually would.

"Patients should attend appointments unless told otherwise. Only contact your GP if it's urgent, and otherwise please use 111 online or call 111."

Speaking of critical services, various train lines are experiencing disruptions in the UK – namely those operated by Govia Thameslink, the UK's largest rail franchise which operates the Thameslink, Southern, Gatwick Express, and Great Northern lines.

A spokesperson said: "We apologize to customers for the disruption they're experiencing this morning. This is due to a worldwide IT issue affecting multiple companies and industries. Our advice to customers is to check our websites for the latest travel information and to check before they travel."

Other train lines affected include: Avanti West Coast, Great Western Railway, Hull Trains, Lumo, TransPennine, and West Midlands Rail.

Over in the US, reports suggest that some states' 911 emergency services are down. So far, it's believed that Ohio, Alaska, Arizona, Minnesota, Indiana, and New Hampshire are affected. Scary stuff.

And who could forget about the poor investment bankers unable to access their news service. Trading at the London Stock Exchange (LSE) is all okay – no worries there – but its regulatory news service (RNS) is down, so companies can't even hide their data breach reports behind the biggest news of the day.

So, what's going on?

The cause of the outages isn't entirely confirmed, but the prevailing explanation is that a faulty channel file in CrowdStrike Falcon – the vendor's flagship EDR solution trusted by organizations the world over – is to blame.

The [10]full advisory is available to paying CrowdStrike customers, however, the director of the vendor's managed hunting service OverWatch, Brody Nisbet, said the dodgy content update has been reversed.

It means there should be no new BSODs going forward, but it won't reverse the damage that's already been done – that'll be a job for IT admins who are sure to have the very worst of Fridays. Hopefully the work doesn't bleed into the weekend.

CrowdStrike hasn't yet responded to our requests for additional information, but Nisbet published a workaround via the vendor's dedicated Reddit page, a thread in which is [11]teeming with furious customers .

However, that workaround will not work for every customer, he [12]Xeeted while also calling the situation "a mess." The company is still working on the issue.

Speaking to BBC Radio 4 this morning, former CEO at the UK's National Cyber Security Centre, Ciaran Martin, concurred with the current explanations for the outage.

"[CrowdStrike] have a range of products under this brand they call Falcon, and their Falcon sensor update, which a lot of companies will use to detect threats and so forth, seems to have been misconfigured in such a way that it wrecks Windows.

"And so if a company is using both CrowdStrike and Windows for its operating system, it seems that they get what people in the trade call the blue screen of death, and Windows doesn't work, and that's why airlines aren't able to process, presumably, why Sky [News] hasn't been able to broadcast. It's also why, just simply for times and reasons, it seems to be emerging first in Australia.

"These complex systems always operate interdependently, so [for] the cybersecurity to do its job, the cybersecurity tool still has to be able to interact with Windows, so companies spend a lot of time, money, and effort on both sides of that equation, making sure that they're compatible when you're deploying these things. You have to make sure you don't destabilize other parts of the network, and most of the time that works. Occasionally, it doesn't – it appears that that's not the case. It's very rare for it to be as serious as this."

[13]CrowdStrike code update bricking Windows machines around the world

[14]Microsoft 365 remains 'degraded' as Azure outage resolved

[15]Elexon's Insight into UK electricity felled by expired certificate

[16]Internet Archive blames 'environmental factors' for overnight outages

CrowdStrike, not Microsoft

Early reporting from national media organizations misattributed the IT issues to Microsoft, which itself battled its own [17]outage hours earlier on its Azure cloud platform , but this appears unrelated to the underlying problem causing the widespread IT issues across the world.

This particular Azure issue was affecting Microsoft 365 subscription services but was already resolved by the time disruption scuppered global systems.

Microsoft found the time to respond to us briefly today, but continued to ignore our repeated requests for an explanation over [18]allegations that it failed to properly notify customers of a Russia-attributed data breach.

A spokesperson said: "We're aware of an issue affecting Windows devices due to an update from a third-party software platform. We anticipate a resolution is forthcoming."

Crowdstrike said in an update that is was "actively working with customers impacted by a defect found in a single content update for Windows hosts.

"Mac and Linux hosts are not impacted. This is not a security incident or cyberattack.

"The issue has been identified, isolated and a fix has been deployed. We refer customers to the support portal for the latest updates and will continue to provide complete and continuous updates on our website.

"We further recommend organizations ensure they're communicating with CrowdStrike representatives through official channels.

"Our team is fully mobilized to ensure the security and stability of CrowdStrike customers." ®

Updated to add:

Crowdstrike has added:

Symptoms include hosts experiencing a bugcheck\blue screen error related to the Falcon Sensor.

Windows hosts which have not been impacted do not require any action as the problematic channel file has been reverted.

Windows hosts which are brought online after 0527 UTC will also not be impacted

Hosts running Windows 7/2008 R2 are not impacted

This issue is not impacting Mac- or Linux-based hosts

Channel file "C-00000291*.sys" with timestamp of 0527 UTC or later is the reverted (good) version.

Channel file "C-00000291*.sys" with timestamp of 0409 UTC is the problematic version.

Get our [19]Tech Resources



[1] https://regmedia.co.uk/2024/07/19/screenie.jpg

[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZpqNmHKU1D9L6fr73UFd9QAAAhc&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0

[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZpqNmHKU1D9L6fr73UFd9QAAAhc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZpqNmHKU1D9L6fr73UFd9QAAAhc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[5] https://www.theregister.co.uk/2024/07/19/crowdstrike_shares_sink_as_global/www.fly.faa.gov

[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZpqNmHKU1D9L6fr73UFd9QAAAhc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[7] https://www.theregister.com/2024/06/20/qilin_our_plan_was_to/

[8] https://regmedia.co.uk/2024/07/19/putneymead_group.jpg

[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZpqNmHKU1D9L6fr73UFd9QAAAhc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[10] https://supportportal.crowdstrike.com/s/login/?ec=302&startURL=%2Fs%2Farticle%2FTech-Alert-Windows-crashes-related-to-Falcon-Sensor-2024-07-19

[11] https://www.reddit.com/r/crowdstrike/comments/1e6vmkf/bsod_error_in_latest_crowdstrike_update/

[12] https://x.com/brody_n77/status/1814187346641990010

[13] https://www.theregister.com/2024/07/19/crowdstrike_falcon_sensor_bsod_incident/

[14] https://www.theregister.com/2024/07/19/microsoft_365_azure_outage_central_us/

[15] https://www.theregister.com/2024/07/09/elexons_insight_expired_cert/

[16] https://www.theregister.com/2024/07/08/internet_archive_suffers_a_wobble/

[17] https://www.theregister.com/2024/07/19/microsoft_365_azure_outage_central_us/

[18] https://www.linkedin.com/posts/kevin-beaumont-security_check-your-email-logs-including-exchange-activity-7215355395878305793-K8n_/

[19] https://whitepapers.theregister.com/