“Due to a bug in the Content Validator, one of the two Template Instances passed validation despite containing problematic content data.”
CrowdStrike’s sensor code gets staged rollouts, internal dogfooding and early adopters. Rapid Response Content got none of that. It went to every Windows host on sensor 7.11 or later between 04:09 and 05:27 UTC, backed by one March stress test and a validator that turned out to be broken. Channel File 291 triggered an out-of-bounds read, and an interpreter “designed to gracefully handle exceptions” crashed Windows instead. The fix list promises canary deployments and customer control over content updates, which tells you exactly what was missing on July 19.