Crowdstrike bypassed WHQL because the update was not to the driver, it was to a configuration file that then gets ingested by the driver. It’s deliberate so they can push out updates for developing threats without being slowed down by the WHQL process.

And that means when they decide to just send it on a Friday with a buggy config file, nobody is responsible but Crowdstrike.