Microsoft IT outage linked to cyber security firm Crowdstrike hits airlines, railways,Tech Companies, Banking,NHS and media outlets globally

Microsoft IT outage linked to cyber security firm Crowdstrike hits airlines, railways, NHS and media outlets globally

There has been a significant global IT outage linked to a software update from the cybersecurity firm CrowdStrike. This update caused widespread disruptions, affecting various sectors including airlines, railways, the NHS, and media outlets.

The outage has led to grounded flights, disrupted banking and technologies operations, and issues with healthcare services. For instance, airlines like American Airlines and Virgin Australia experienced major operational problems, and many GP surgeries in England were affected. Microsoft is working on mitigation actions, but the issue has caused considerable inconvenience globally.

What is CrowdStrike?

Let us tell you that Crowdstrike is a cyber security company. It offers an advanced cybersecurity solution for most computers and laptops around the world. According to the continuous reports about this, one of the main products of Crowd Strike is Falcon and there has been a big error in this product.

Explain that Crowdstrike gives its users a cloud-based endpoint protection solution. The company’s Falcon product detects malicious files on the network. It uses AI technology to stop the virus detecting malicious files. Falcon can do endpoint security whether the system is online or offline.

Who is affected by the CloudStrike update?

Cause:

The outage appears to be related to a faulty update from CrowdStrike, a global cybersecurity firm that provides endpoint security for Windows systems.
Computers relying on automatic updates from CrowdStrike are stuck in a recovery boot loop, rendering them unable to start properly.
Microsoft is actively taking mitigation action to address the lingering impact of this incident.

The good news is that a fix has already been found. The bad news is that as servers are not booting it is likely that a large number of servers around the globe will require manual intervention. CrowdStrike gave the following instructions on how to fix the issue.

1. Boot Windows into Safe Mode or the Windows Recovery Environment
2. Navigate to the C:\Windows\System32\drivers\CrowdStrike directory
3. Locate the file matching C-00000291*.sys* and delete it
4. Boot the host normally

Microsoft then issued further advice

1. We recommend customers that are able to, to restore from a backup from before 19:00 UTC on the 18th of July
2. Alternatively, attempt to repair the OS disk offline.
3. Attach a disk to VM for offline repair (Encrypted disks may need further instructions)
4. Once the disk is attached delete the  Windows/System/System32/Drivers/CrowdStrike/C00000291*.sys file
5. We can confirm the affected update has been pulled by CrowdStrike. Customers that are continuing to experience issues should reach out to CrowdStrike for additional assistance.

Let’s hope temp solution will work !!