Cybersecurity firm CrowdStrike Holdings Inc (NASDAQ:CRWD) has published a preliminary post-incident review (PIR) detailing the events that led up to a global IT outage that knocked millions of Microsoft Windows computer systems offline on Friday, 19 July.
According to CrowdStrike, a content update containing an undetected error was inadvertently pushed through its systems.
CrowdStrike’s content validator, which is designed to perform validation checks on content before it is published, contained a bug that allowed “problematic content data” to pass undetected.
The update, which was intended to gather telemetry on potential new threat techniques, caused Windows systems running sensor version 7.11 and above to crash. Mac and Linux hosts were not affected by this issue.
That bug unfolded into a calamitous IT outage that hobbled businesses, transport infrastructure, emergency services and telecommunications networks on Friday.
It continued to cause a global headache over the weekend.
CrowdStrike founder and chief executive George Kurtz warned that “adversaries and bad actors will try to exploit events like this” and encouraged customers “to remain vigilant and ensure that you’re engaging with official CrowdStrike representatives”.
“I want to sincerely apologize directly to all of you for the outage,” said Kurtz. “All of CrowdStrike understands the gravity and impact of the situation. We quickly identified the issue and deployed a fix, allowing us to focus diligently on restoring customer systems as our highest priority.”
CrowdStrike shares tumbled following the incident, with a quarter of the Nasdaq-listed company’s valuation wiped out.
CrowdStrike intends to publicly publish a full post-mortem in due course.