The HR platform has taken its systems down across three regions, interrupting payroll, as governments and companies rushed to patch a critical flaw in software that runs much of the web
Earlier today, in the middle of a pay cycle, thousands of HR teams opened BambooHR and found a maintenance page.
The Utah-based HR software company took its platform offline in the United States, Canada and Ireland. It said it was acting as a precaution against PHP2Shell, a pair of critical security flaws in PHP, the programming language behind a large share of the world’s websites. “We know this interrupts essential work, including payroll, and we’re sorry for the disruption,” the company said on its status page.
BambooHR first flagged the threat at 4:46 a.m. Mountain time. It took the service down about an hour later and said its engineering and security teams had been watching its systems through the night. By 9:03 a.m., the company said it had applied the recommended fix and was testing its systems before restoring access. It reported that BambooHR was back online as of 12:01 p.m. Mountain Time.
BambooHR has not said that any customer data was accessed. It described the shutdown as preventive, and security researchers have said the same of other organizations that went offline.
A bad day for much of the web
BambooHR had plenty of company. Across Europe, governments switched off public websites. In Finland, the government took its public-facing online services offline. In the Netherlands, the national cybersecurity agency shut down its own website, along with DigiD, the country’s national login system, and the online services portal MijnOverheid. In Belgium, the Flemish government and parliament and the foreign ministry went dark. Nintendo and a string of Japanese online services, including a childcare app used by working parents, also announced shutdowns or emergency maintenance.
The trouble began Tuesday. According to Huntress, details of the flaws leaked online before their planned disclosure. PHP’s security team moved its emergency fix forward and rated both flaws 9.2 out of 10 for severity. Researchers at Palo Alto Networks’ Unit 42 said either flaw could let an attacker run their own code on a server without logging in. The patched versions, PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, were released Wednesday afternoon, European time.
Before the patch arrived, Cloudflare’s chief technology officer, Dane Knecht, said on X that the company was seeing early attacks and had put up temporary firewall rules. He added a warning: “This is a STOPGAP only. Patch as soon as PHP releases the update.”
There is also an artificial intelligence angle. Researchers at the cloud security firm Wiz said the underlying bugs had existed for decades, and that turning them into a working attack had been extremely hard. “Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit,” they said.
Canada’s federal government also took a number of its websites offline on Wednesday. Evan Solomon, Canada’s Minister of Artificial Intelligence and Digital Innovation, confirmed the shutdowns were a precautionary measure. “This is in response to a vulnerability identified in PHP, software used by websites around the world,” Solomon posted on X. "If your organization uses PHP, apply the latest security updates as soon as possible..." Solomon said the shutdowns were carried out in line with recommendations from the Canadian Centre for Cyber Security (CCCS).
The websites of Statistics Canada and the CCCS itself were among the federal sites affected. Provincial government sites in Newfoundland and Labrador and Prince Edward Island were also offline, displaying messages citing a global security incident. The British Columbia government posted on social media that it had taken some of its webpages offline “as a precaution following a new global cybersecurity vulnerability,” with teams working to restore services as soon as possible.
Montreal’s transit authority, the Société de transport de Montréal (STM), shut down its stm.info website just before noon on Wednesday. Several of those federal sites, including Statistics Canada, remained unavailable Thursday morning as millions of attempted exploits were reported across the internet, Global News reported.
The PHP Foundation was unequivocal in its guidance: “If you run PHP, it is imperative that you update now.” Cybersecurity experts described it as one of the largest online vulnerability issues they have ever had to fix, according to CTV News.
Why so many systems were exposed
PHP runs roughly seven in 10 websites whose server-side language can be identified, according to the web technology tracker W3Techs. It is also the foundation of WordPress, which hosts many company careers pages, intranets and benefits sites.
The fix is simplest for organizations on supported versions of PHP. Websites on older versions face a harder job: they either have to apply source-code fixes themselves or upgrade to a newer version of PHP.
Payroll day without your HRIS
For HR leaders, the BambooHR outage is a real-world test of a scenario most continuity plans mention only briefly: the core HR system is unavailable, and payday is coming.
Check the payroll calendar first. If a payroll run is due before service returns, HR should talk to finance about a fallback. Options include rerunning the last approved payroll, processing manually through the bank, or paying a set amount and correcting it later. Many jurisdictions set strict deadlines for paying wages, so employers should check the rules where their staff work before deciding to wait.
Tell employees before the rumors start. Staff who can’t see their payslips, request time off or update their details will notice quickly. A short, honest message works best. It should say what is down, why, what HR is doing and where employees can get help in the meantime. In Belgium, several organizations described Wednesday’s outages only as “maintenance.” That kind of vague notice tends to make employees more anxious, not less.
Warn employees about fake “BambooHR” emails. Scammers move quickly after any widely reported outage. Messages asking employees to “log in to restore access” or “confirm your bank details” are a likely next step. HR should tell staff that it will never ask for passwords or banking changes by email or text. HR should also confirm any change to direct deposit details by phone. That advice comes from recent experience: after hackers broke into Oracle PeopleSoft payroll systems, stolen bank details became the way criminals diverted employees’ wages.
Ask your other vendors the same question. BambooHR told customers what it was doing. Not every vendor will. HR should ask its payroll, benefits, applicant tracking and HR software vendors whether they use PHP and whether they have patched. It should also ask the same of whoever runs the company’s careers site and intranet, and get the answers in writing. Mandiant’s warning from the PeopleSoft attacks still applies: workarounds “are not a substitute for patching.”
Remember the people doing the patching. Emergency patch days mean long nights for IT and security staff. If, as Wiz suggests, AI is shrinking the gap between a flaw being found and a working attack, these days will become more common. Criminals are already using AI to scale up their schemes against employers. HR should ask whether those teams have the staff and rest they need to handle the next one.
This story is developing. BambooHR did not immediately respond to requests for comment.
