Major HR system goes offline as critical cyber flaw drives wave of global shutdowns

BambooHR has not said that any customer data was accessed. It described the shutdown as preventive, and security researchers have said the same of other organizations that went offline.

A bad day for much of the web

BambooHR had plenty of company. Across Europe, governments switched off public websites. In Finland, the government took its public-facing online services offline. In the Netherlands, the national cybersecurity agency shut down its own website, along with DigiD, the country’s national login system, and the online services portal MijnOverheid. In Belgium, the Flemish government and parliament and the foreign ministry went dark. Nintendo and a string of Japanese online services, including a childcare app used by working parents, also announced shutdowns or emergency maintenance.

The trouble began Tuesday. According to Huntress, details of the flaws leaked online before their planned disclosure. PHP’s security team moved its emergency fix forward and rated both flaws 9.2 out of 10 for severity. Researchers at Palo Alto Networks’ Unit 42 said either flaw could let an attacker run their own code on a server without logging in. The patched versions, PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, were released Wednesday afternoon, European time.

Before the patch arrived, Cloudflare’s chief technology officer, Dane Knecht, said on X that the company was seeing early attacks and had put up temporary firewall rules. He added a warning: “This is a STOPGAP only. Patch as soon as PHP releases the update.”

There is also an artificial intelligence angle. Researchers at the cloud security firm Wiz said the underlying bugs had existed for decades, and that turning them into a working attack had been extremely hard. “Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit,” they said.