BambooHR took its HR and payroll platform offline in the US, Canada and Ireland on 21 October as a precaution against PHP2Shell, a pair of critical flaws in the PHP language. The service was down from 11:51 to 18:01 UTC, in the middle of a working day for its customers in all three regions.
What BambooHR said, hour by hour
BambooHR’s status page logged the incident as a security issue covering app.bamboohr.com in the US, Canada and Ireland and the www.bamboohr.com site. The first notice, at 10:46 UTC, said the company was aware of PHP2Shell and monitoring its systems, and that it would take BambooHR offline as a precaution if needed.
At 11:51 UTC it did. “We know this interrupts essential work, including payroll, and we’re sorry for the disruption,” the company wrote, adding that it had no confirmed restoration time. At 15:03 UTC BambooHR said it had applied the recommended security fix and was testing affected systems. At 16:01 UTC it reported that initial tests of the security patches had passed, and at 18:01 UTC it marked the incident resolved, with a warning that customers could see slower page loads or intermittent errors for the rest of the day.
Every notice framed the shutdown as a step to protect customer data. None of them reports an intrusion, and the status page does not say how many customers were mid-way through a pay run when access stopped.
Why a language flaw reached an HR system
PHP2Shell is the name given to CVE-2026-109618 and CVE-2026-109619, two flaws in PHP itself, the server language behind a large part of the web. The PHP project shipped fixed releases, PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, at 14:00 UTC on 21 October. In its release post, the PHP Foundation said both flaws can, under the right conditions, let an unauthenticated attacker run code on servers running PHP, and told users: “If you run PHP, it is imperative that you update now.”
The timing was compressed. The Foundation says the two CVE numbers started circulating online at around 15:00 UTC on 20 October, so the project moved its release forward by a day, from 22 October to 21 October. That left operators like BambooHR a few hours between the warning and the fix.
The flaws sit below the application. Wiz Research, one of the teams that reported them, wrote in its technical write-up that even a simple application running on an affected PHP version can be vulnerable, and that attackers could also read process memory. “That memory may contain passwords, authentication tokens, API keys and certificates belonging to other requests or the server itself,” Wiz wrote. For a system that holds salaries, bank details and national ID numbers, that is the exposure an HR vendor has to weigh against a few hours of downtime.
Calif, the security firm that first reported the root cause, lists the applications on which it confirmed attacks without a login in its research post. They include WordPress, Drupal, Nextcloud, Laravel and Symfony, which are common building blocks for company intranets, careers sites and internal HR tools as well as vendor platforms.
How precautionary shutdowns change payroll planning
Most HR continuity planning starts from two events: the vendor has an outage, or the vendor is breached. A precautionary shutdown is a third case. The vendor chooses to go dark, on its own schedule, because it judges the risk of staying up to be higher than the cost of stopping.
In our reading, BambooHR made that choice in the open, with a warning an hour before, a stated reason, a fix applied and tested, and a time-stamped return. Customers still lost access for a working afternoon in Europe and a working morning in North America, and the company said in plain terms that payroll was affected.
The same questions apply to every HR vendor. BambooHR’s own Claude connector launch earlier this month is one sign of how many outside tools now plug into a core HR system, and each connected tool runs on its own stack. When we looked at why payroll is where AI trust breaks down, the reason was the same one this incident shows: a payroll error or delay reaches every employee’s bank account on a fixed date.
What it means for the HR leader
PHP2Shell will not be the last flaw in a widely used language or library. The questions it raises for HR and payroll teams are practical:
- Know the stack. Ask each HRIS, payroll, applicant tracking and benefits vendor whether its service runs on PHP, and if so whether it has deployed one of the fixed releases or a vendor-patched build. Linux distributions received patches in advance, so a version number alone may not show the fix.
- Read the contract for this case. Check whether your service-level terms treat a vendor’s own precautionary shutdown as downtime that counts against its commitment, or as planned maintenance that does not.
- Keep an offline path for pay day. Payroll teams that had last cycle’s register, bank file and employee changes exported could have finished a run by hand or with their bank. A team with nothing outside the platform had no way to run payroll until access returned.
- Check your own PHP. Careers pages, intranets and HR portals built on WordPress or Drupal are in scope even when the core HR suite is not.
- Ask about the days before the fix. Amazon Threat Intelligence reported an exploit attempt against its honeypots on 17 October, four days before the release. Ask each vendor what it reviewed in its logs from 17 October onward.
Source: BambooHR status page, “BambooHR Temporarily Unavailable: Security Precaution”
