Major HR System Goes Offline as Critical Cyber Flaw Drives Wave of Global Shutdowns

The human resources platform BambooHR took its systems down across three regions, interrupting critical payroll processes as governments and companies worldwide rushed to patch a severe software vulnerability affecting a massive portion of the modern web.

Earlier today, in the middle of a delicate pay cycle, thousands of human resources professionals opened up BambooHR only to be greeted by an unexpected maintenance page. The Utah-based HR software company abruptly took its platform offline across the United States, Canada, and Ireland. The company explained that the drastic move was taken as a strict precaution against PHP2Shell, a pair of critical security flaws discovered in PHP, the foundational programming language that drives a vast share of the world’s websites and web applications.

"We know this interrupts essential work, including payroll, and we’re sorry for the disruption," the company stated on its official status page, adding that it had no confirmed time for restoring service when the shutdown first began.

BambooHR initially flagged the mounting threat at 4:46 a.m. Mountain Time. Recognizing the potential severity of the exposure, the organization took the service down approximately an hour later, noting that its engineering and security teams had been monitoring systems vigilantly through the night. By 9:03 a.m., the company announced it had successfully applied the recommended security patch and was actively testing its infrastructure before gradually restoring access. Operations were officially reported back online as of 12:01 p.m. Mountain Time.

To this point, BambooHR has not reported any unauthorized access to customer data or evidence of compromise. The company characterized the temporary shutdown entirely as a preventive measure, a stance echoed by independent security researchers regarding other organizations that elected to take their web properties offline during the same window.

A Bad Day for Much of the Web

BambooHR was far from alone in facing difficult security decisions. Across Europe and beyond, governments, public agencies, and major enterprises switched off public-facing websites to mitigate potential exploitation. In Finland, the national government took its public-facing online services completely offline. In the Netherlands, the national cybersecurity agency shut down its own website alongside DigiD, the country’s primary national login system, and the online services portal MijnOverheid.

The disruption extended into Belgium, where the Flemish government, the Flemish parliament, and the federal foreign ministry all temporarily went dark. Major global brands also felt the impact; Nintendo and a string of Japanese online services—including a widely used childcare application relied upon by working parents—announced emergency maintenance and sudden shutdowns.

The technical trouble began Tuesday. According to reports from cybersecurity firm Huntress, technical details regarding the flaws leaked online well ahead of their planned public disclosure. This forced the PHP security team to accelerate its emergency patch schedule, ultimately rating both discovered flaws an alarming 9.2 out of 10 for severity. Researchers at Palo Alto Networks’ Unit 42 warned that either flaw could theoretically allow an untrusted attacker to execute arbitrary code on an affected server without needing legitimate login credentials. The official patched versions—identified as PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35—were subsequently released Wednesday afternoon in European time zones.

Before the official patches arrived, Cloudflare Chief Technology Officer Dane Knecht noted on social media platform X that the company was already observing early wave attacks in the wild and had deployed temporary firewall rules as a defense. He issued a blunt warning to network administrators: "This is a STOPGAP only. Patch as soon as PHP releases the update."

The incident has also highlighted a growing concern regarding artificial intelligence in cybersecurity. Researchers at cloud security firm Wiz pointed out that while the underlying software bugs had technically existed for decades, developing a reliable, working exploit had historically required immense human effort and specialized skill. "Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit," the researchers noted.

Why So Many Systems Were Exposed

The immense scope of the disruption stems from the ubiquity of the underlying technology. PHP runs roughly seven in every 10 websites whose server-side programming language can be definitively identified, according to web technology tracker W3Techs. Furthermore, it serves as the foundational architecture for WordPress, which hosts a staggering number of corporate careers pages, internal employee intranets, and employee benefits portals.

Applying the fix is relatively straightforward for organizations running actively supported versions of PHP. However, websites relying on older, legacy versions face a far more complex and labor-intensive task, forcing system administrators to either manually apply source-code fixes themselves or undertake major upgrades to newer iterations of PHP.

Payroll Day Without Your HRIS

For human resources leaders, the abrupt BambooHR outage served as a high-stakes, real-world test of a continuity scenario that most disaster recovery plans address only briefly: what happens when the core human resources system is completely unavailable right as payday arrives?

When facing such a crisis, professionals recommend prioritizing the payroll calendar first. If a payroll run is scheduled to process before service returns, human resources teams must immediately coordinate with finance departments to establish a fallback strategy. Potential options include rerunning the last previously approved payroll, processing transactions manually through banking institutions, or issuing estimated payments with subsequent corrections. Because many regional and national jurisdictions enforce strict statutory deadlines for paying earned wages, employers must verify local regulatory requirements before deciding to delay payments.

Equally critical is transparent communication with employees before rumors begin to circulate. Staff members who suddenly find themselves unable to view their payslips, submit time-off requests, or update personal information will notice the disruption almost immediately. A direct, honest message remains the most effective approach, clearly outlining what systems are currently down, why the action was taken, what human resources is doing to resolve it, and where employees can direct questions in the interim. For instance, several Belgian organizations described Wednesday’s outages merely as routine "maintenance," an ambiguous notice that tended to heighten employee anxiety rather than alleviate it.

Organizations must also remain vigilant against secondary security threats, specifically warning employees about opportunistic phishing campaigns. Cybercriminals frequently move quickly to exploit the confusion following widely reported technology outages. Deceptive communications purporting to be from human resources—such as messages asking employees to "log in to restore access" or "confirm your bank details"—represent a predictable next step for malicious actors. Human resources should explicitly remind staff that the company will never ask for passwords or banking modifications via email or text message, and any direct deposit changes should always be verified independently by phone. This caution is underscored by recent history; following past security breaches involving Oracle PeopleSoft payroll systems, compromised bank details quickly became a primary vector for criminals attempting to divert employee wages.

Organizations are also advised to audit their wider vendor ecosystems. While BambooHR proactively communicated its preventive actions to customers, not every software vendor operates with the same transparency. Human resources departments should directly ask their payroll, benefits, applicant tracking, and broader software vendors whether they rely on PHP infrastructure and whether necessary patches have been successfully applied. The same inquiry should extend to whoever manages corporate careers pages and internal intranets, with written confirmation secured where possible.

Finally, the incident casts a spotlight on the personnel tasked with emergency responses. Emergency patch cycles invariably mean exhausting, sleepless nights for information technology and security staff. As artificial intelligence continues to shrink the timeline between the discovery of a vulnerability and the deployment of a working exploit, such emergency events are likely to become more frequent. With criminal enterprises already leveraging advanced automation and AI to scale up malicious schemes against corporate employers, organizational leaders must ensure their technical teams have the necessary resources and operational support to handle the ongoing threat landscape.