The HR platform has taken its systems down across three regions, interrupting payroll, as governments and companies rushed to patch a critical flaw in software that runs much of the web
Earlier today, in the middle of a pay cycle, thousands of HR teams opened BambooHR and found a maintenance page.
The Utah-based HR software company took its platform offline in the United States, Canada and Ireland. It said it was acting as a precaution against PHP2Shell, a pair of critical security flaws in PHP, the programming language behind a large share of the world’s websites. “We know this interrupts essential work, including payroll, and we’re sorry for the disruption,” the company said on its status page, adding that it had no confirmed time for restoring service.
BambooHR first flagged the threat at 4:46 a.m. Mountain time. It took the service down about an hour later and said its engineering and security teams had been watching its systems through the night. By 9:03 a.m., the company said it had applied the recommended fix and was testing its systems before restoring access. It reported that BambooHR was back online as of 12:01 p.m. Mountain Time.
BambooHR has not said that any customer data was accessed. It described the shutdown as preventive, and security researchers have said the same of other organizations that went offline.
A bad day for much of the web
BambooHR had plenty of company. Across Europe, governments switched off public websites. In Finland, the government took its public-facing online services offline. In the Netherlands, the national cybersecurity agency shut down its own website, along with DigiD, the country’s national login system, and the online services portal MijnOverheid. In Belgium, the Flemish government and parliament and the foreign ministry went dark. Nintendo and a string of Japanese online services, including a childcare app used by working parents, also announced shutdowns or emergency maintenance.
The trouble began Tuesday. According to Huntress, details of the flaws leaked online before their planned disclosure. PHP’s security team moved its emergency fix forward and rated both flaws 9.2 out of 10 for severity. Researchers at Palo Alto Networks’ Unit 42 said either flaw could let an attacker run their own code on a server without logging in. The patched versions, PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, were released Wednesday afternoon, European time.
Before the patch arrived, Cloudflare’s chief technology officer, Dane Knecht, said on X that the company was seeing early attacks and had put up temporary firewall rules. He added a warning: “This is a STOPGAP only. Patch as soon as PHP releases the update.”
There is also an artificial intelligence angle. Researchers at the cloud security firm Wiz said the underlying bugs had existed for decades, and that turning them into a working attack had been extremely hard. “Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit,” they said.
Why so many systems were exposed
PHP runs roughly seven in 10 websites whose server-side language can be identified, according to the web technology tracker W3Techs. It is also the foundation of WordPress, which hosts many company careers pages, intranets and benefits sites.
The fix is simplest for organizations on supported versions of PHP. Websites on older versions face a harder job: they either have to apply source-code fixes themselves or upgrade to a newer version of PHP.
Payroll day without your HRIS
For HR leaders, the BambooHR outage is a real-world test of a scenario most continuity plans mention only briefly: the core HR system is unavailable, and payday is coming.
Check the payroll calendar first. If a payroll run is due before service returns, HR should talk to finance about a fallback. Options include rerunning the last approved payroll, processing manually through the bank, or paying a set amount and correcting it later. Many jurisdictions set strict deadlines for paying wages, so employers should check the rules where their staff work before deciding to wait.
Tell employees before the rumors start. Staff who can’t see their payslips, request time off or update their details will notice quickly. A short, honest message works best. It should say what is down, why, what HR is doing and where employees can get help in the meantime. In Belgium, several organizations described Wednesday’s outages only as “maintenance.” That kind of vague notice tends to make employees more anxious, not less.
Warn employees about fake “BambooHR” emails. Scammers move quickly after any widely reported outage. Messages asking employees to “log in to restore access” or “confirm your bank details” are a likely next step. HR should tell staff that it will never ask for passwords or banking changes by email or text. HR should also confirm any change to direct deposit details by phone. That advice comes from recent experience: after hackers broke into Oracle PeopleSoft payroll systems, stolen bank details became the way criminals diverted employees’ wages.
Ask your other vendors the same question. BambooHR told customers what it was doing. Not every vendor will. HR should ask its payroll, benefits, applicant tracking and HR software vendors whether they use PHP and whether they have patched. It should also ask the same of whoever runs the company’s careers site and intranet, and get the answers in writing. Mandiant’s warning from the PeopleSoft attacks still applies: workarounds “are not a substitute for patching.”
Remember the people doing the patching. Emergency patch days mean long nights for IT and security staff. If, as Wiz suggests, AI is shrinking the gap between a flaw being found and a working attack, these days will become more common. Criminals are already using AI to scale up their schemes against employers. HR should ask whether those teams have the staff and rest they need to handle the next one.
This story is developing. BambooHR did not immediately respond to requests for comment.
