At 04:09 UTC on Friday, July 19, 2024, CrowdStrike pushed a routine content update to its Falcon security sensor. Within roughly ninety minutes the file was withdrawn. It was already far too late. Approximately 8.5 million Windows machines — under one percent of all Windows systems in the world — crashed into the blue screen of death, and because the fault sat in a kernel-level driver, most could not simply be rebooted out of it. Each machine needed hands: boot into safe mode, delete a file, restart. Millions of machines, one at a time, many of them behind locked doors in server rooms, on aircraft, in hospitals.
The consequences were immediate and physical. Airlines grounded fleets and reverted to handwritten boarding passes; one US carrier took the better part of a week to recover, cancelling thousands of flights. Hospitals postponed procedures and lost access to records. Banks, broadcasters, retailers, and some emergency call centres went dark. It was the largest IT outage in history, and insurers would later estimate the cost to US Fortune 500 companies alone in the billions.
The technical cause was almost insultingly small. The update's template defined 21 input fields; the sensor code supplied 20. A missing bounds check and a validator that failed to catch the mismatch turned that off-by-one into an out-of-bounds read inside the kernel — and a kernel fault is not an error message, it is a dead machine. The deeper cause was structural, and it is the reason this edition leads with it. Security software earns its keep by running with the deepest privileges on a system and updating faster than any change-control board could approve. Both of those properties are necessary. Both of them mean that a defect in the defender propagates at the speed and scale of an attack — with none of the friction that would slow an actual adversary.
Nobody had attacked anyone. That is what made July 19 unforgettable: the industry looked directly at a self-inflicted global outage and had to accept that its own architecture of trust was the delivery mechanism.
AT&T and the records of nearly everyone
On July 12, AT&T disclosed that attackers had obtained call and text metadata covering nearly all its wireless customers — roughly 109 million accounts — for periods in 2022. The data was not content, but metadata is its own kind of intimacy: who called whom, how often, for how long, in what pattern. The theft came from the company's tenancy on the Snowflake cloud data platform, part of a campaign that swept up dozens of major brands through one repeated failure: credentials stolen by infostealer malware, reused on accounts without multi-factor authentication. Snowflake itself was never breached. Its customers were, one unprotected login at a time.
Concentration, quantified
July 19 also functioned as an unplanned census of concentration risk. A single vendor's sensor sat inside airlines, hospitals, ports, banks, and government departments across dozens of countries — a dependency nobody had mapped because each organisation had procured it independently and reasonably. Regulators in several jurisdictions opened reviews; boards discovered the phrase "single point of failure" applied to software they had bought for resilience. It is the same lesson the AWS, Azure, and Cloudflare outages would teach in late 2025, and the reason "multi-provider" stopped being an architectural luxury.
WazirX loses $235 million — and previews a bigger heist
On July 18, 2024, India's largest cryptocurrency exchange, WazirX, lost roughly $235 million in a single attack on a multi-signature wallet. The method is worth studying closely, because it would return: rather than stealing keys, the attackers manipulated what the wallet's authorised signers were approving, altering the underlying smart contract so that the signatures collected in good faith handed over control of the funds. Analysis linked the theft to the North Korea-associated Lazarus Group. WazirX froze withdrawals, and Indian users spent months in limbo over a restructuring process.
Seven months later, attackers using a strikingly similar playbook — deceive the signers, not the keys — took $1.5 billion from Bybit, as our February 2025 edition records. India's largest crypto loss was, in hindsight, the rehearsal.
Open weights reach frontier scale
On 23 July 2024 Meta released Llama 3.1, whose 405-billion-parameter model was the largest openly available system to that point — a 128,000-token context window, eight supported languages, and weights any organisation could download and run on its own hardware. Meta described it as open source; the Open Source Initiative and the Free Software Foundation both declined the label, pointing to a licence that imposes commercial terms on anyone serving more than 700 million monthly active users and restricts permitted uses. Mistral answered the next day with Large 2, a 123-billion-parameter model issued for research and non-commercial use, commercial deployment requiring a separate agreement. On 25 July OpenAI announced SearchGPT, a prototype pairing its models with live web results for a small group of users and publishers; it was folded into ChatGPT as ChatGPT search that October. The 405B release is the one that mattered — it established that frontier-scale weights could simply be published, though the lead in doing so has since passed from Meta to others.
The industry reopens the kernel question
The scale came from Microsoft rather than CrowdStrike: on 20 July 2024, in a post by its vice-president for enterprise and operating system security, Microsoft put the number of affected Windows devices at approximately 8.5 million, under one percent of the installed base — the first hard figure either company had offered. What the industry took from the weekend, beyond the outage this edition already recounts, was a question it had avoided for two decades: why endpoint agents run inside the Windows kernel at all. Microsoft convened a closed Windows Endpoint Security Ecosystem Summit at Redmond on 10 September 2024, with rival vendors and government representatives present, and afterwards set out plans for a platform letting security products operate outside kernel mode. Commercially the argument moved to court: Delta sued CrowdStrike on 25 October 2024 over more than $500 million in claimed losses, and CrowdStrike countersued the same day, disputing that account and blaming the airline's own recovery. By July 2025 the new platform was in private preview with CrowdStrike, Bitdefender, ESET, SentinelOne, Sophos and Trend Micro among the participants.
⏳ Time capsule — July 2024
- Handwritten boarding passes at major international airports became the defining image of the year in technology.
- The Paris Olympics opened a week later, with organisers watching their own dependency lists rather nervously.
- "Have you tried booting into safe mode?" briefly became a phrase heard in hospital corridors and airline crew rooms.
- CrowdStrike's share price fell sharply; its competitors' rose — the market's crude verdict on concentration.
Staged rollouts, and a permanent lesson
July 19, 2024 changed how security software ships. Phased and canary deployment of content updates, customer-controlled update rings, and — following an industry summit with Microsoft — serious work on moving endpoint security out of the Windows kernel all trace to that morning. Regulators added software resilience to operational-risk frameworks, and "what happens if our security vendor breaks?" entered standard third-party questionnaires. The Snowflake campaign, meanwhile, made MFA-on-everything a board-level mandate and previewed the identity-first attacks that dominate this archive's later years. And WazirX's stolen $235 million remains, for Indian regulators, the case that made crypto custody a systemic question rather than a niche one.