
{"id":8402,"date":"2024-07-19T10:50:57","date_gmt":"2024-07-19T10:50:57","guid":{"rendered":"https:\/\/rax-stg-wp-aws.com\/blogs\/rackspace-technology-response-to-crowdstrike-july-incident\/"},"modified":"2026-11-03T19:29:36","modified_gmt":"2026-11-03T19:29:36","slug":"rackspace-technology-response-to-crowdstrike-july-incident","status":"publish","type":"blogs","link":"https:\/\/www.rackspace.com\/en-gb\/blogs\/rackspace-technology-response-to-crowdstrike-july-incident\/","title":{"rendered":"Rackspace Technology response to Crowdstrike July Incident"},"content":{"rendered":"<p>Starting on 18 July 2024, at 23:49 CDT, Rackspace became aware of an issue following a recent CrowdStrike update impacting systems running various CrowdStrike sensor versions. Impacted users were getting a BSOD (Blue Screen of Death) error and systems were rebooting automatically.&nbsp;<\/p>\n<p lang=\"EN-US\">CrowdStrike identified issues related to the Falcon sensor and provided recommended workarounds on the affected Windows-hosted systems. CrowdStrike&nbsp;has since identified and isolated the issue and deployed a fix.&nbsp;<\/p>\n<p lang=\"EN-US\">Rackspace engineers continue to implement the solution on remaining impacted devices.&nbsp;<\/p>\n<p><strong>Details&nbsp;<\/strong><br \/>\nSymptoms include hosts experiencing a bugcheck\\blue screen error related to the Falcon Sensor.&nbsp;<\/p>\n<p lang=\"EN-US\"><strong>Current action&nbsp;<\/strong><br \/>\nCrowdStrike Engineering has identified a content deployment related to this issue and reverted those changes.&nbsp;<br \/>\nIf hosts are still crashing and unable to stay online to receive the Channel File Changes, the following steps can be used to workaround this issue:&nbsp;<\/p>\n<p lang=\"EN-US\"><strong>Workaround Steps:&nbsp;<\/strong><br \/>\n1. Boot Windows into Safe Mode or the Windows Recovery Environment&nbsp;<br \/>\n2. Navigate to the C:\\Windows\\System32\\drivers\\CrowdStrike directory&nbsp;<br \/>\n3. Locate the file matching &#8220;C-00000291*.sys&#8221;, and delete it.&nbsp;<br \/>\n4. Boot the host normally.&nbsp;<\/p>\n<p>If you have any questions, please contact a member of your support team.&nbsp;<\/p>\n<p lang=\"EN-US\">Please refer to the following vendor pages for the latest updates and workarounds:&nbsp;<\/p>\n<p><a href=\"https:\/\/www.crowdstrike.com\/blog\/statement-on-falcon-content-update-for-windows-hosts\/\">https:\/\/www.crowdstrike.com\/blog\/statement-on-falcon-content-update-for-windows-hosts\/<\/a>&nbsp;<\/p>\n<p><a href=\"https:\/\/status.cloud.google.com\/incidents\/DK3LfKowzJPpZq4Q9YqP#FxgErUaBEZS6pEeX6yiz\">https:\/\/status.cloud.google.com\/incidents\/DK3LfKowzJPpZq4Q9YqP#FxgErUaBEZS6pEeX6yiz<\/a>&nbsp;<\/p>\n<p><a href=\"https:\/\/azure.status.microsoft\/en-us\/status\">https:\/\/azure.status.microsoft\/en-us\/status<\/a>&nbsp;<\/p>\n<p><a href=\"https:\/\/health.aws.amazon.com\/health\/status\">https:\/\/health.aws.amazon.com\/health\/status<\/a>&nbsp;<\/p>\n<p class=\"MsoNormal\">&nbsp;<\/p>\n<p class=\"MsoNormal\">&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Rackspace Technology response to Crowdstrike July Incident<\/p>\n","protected":false},"author":2,"featured_media":8404,"menu_order":0,"comment_status":"open","ping_status":"open","template":"","format":"standard","meta":{"content-type":"","nid":"27031","content_type":"blog","created_by":"10130","authored_on":"2024-07-19T10:50:57+00:00","field_article_industries":"","tag_category":"Technical","field_blog_author_text":"by Rackspace Technology Security Team","seo_description":"Rackspace Technology addresses Crowdstrike's July Vulnerability with swift action. Learn about our proactive security measures to protect your data. Stay secure with Rackspace.","field_featured_image":"","insights_image":"\/wp-content\/uploads\/2026\/blog_technical_images\/27031-insights_image-how-to-technical-blog-1-insights.jpg","field_partners":"","rxt_platforms":"","product":"","publisheddate":"2024-07-19T10:50:57","rxt_solutions":"","opengraph_tag":"","x_tag":"","teaser_flag":"Technical Blog","seo_titile":"Rackspace Technology response to Crowdstrike July Vulnerability | Rackspace Technology","field_topics":"","field_slug":"rackspace-technology-response-to-crowdstrike-july-incident","footnotes":""},"categories":[178],"tags":[204],"class_list":["post-8402","blogs","type-blogs","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-technical"],"_links":{"self":[{"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/blogs\/8402","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/blogs"}],"about":[{"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/types\/blogs"}],"author":[{"embeddable":true,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/comments?post=8402"}],"version-history":[{"count":1,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/blogs\/8402\/revisions"}],"predecessor-version":[{"id":8403,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/blogs\/8402\/revisions\/8403"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/media\/8404"}],"wp:attachment":[{"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/media?parent=8402"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/categories?post=8402"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/tags?post=8402"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}