BambooHR went offline for six hours to patch PHP, halting payroll work

BambooHR went offline for six hours to patch PHP, halting payroll work

21 October 2026: BambooHR, the HR and payroll software company, took its application offline in the US, Canada and Ireland for about six hours on 21 October as a precaution against the critical PHP flaws disclosed that day, and brought it back after patching. "We know this interrupts essential work, including payroll, and we're sorry for the disruption," the company told customers on its status page.

Not yet independently verified. BambooHR has not said how many customers or payroll runs were affected, or whether it found any sign of attack; the timeline is from its own status page. We will update this when it can be confirmed, and remove this note.

The day hour by hour

All times are as BambooHR posted them, in UTC:

• 10:46: BambooHR says it is aware of the vulnerability, which it calls PHP2SHELL, and is watching its systems, warning it may go offline as a precaution.
• 11:51: the service is taken offline, with no restoration time given.
• 15:03: the recommended security fix is applied and systems are being tested.
• 16:01: first tests pass; features are being validated.
• 18:01: BambooHR is back online, with a warning that pages may load slowly or show errors for the rest of the day.

The outage covered the application in its US data centres (us-east-1 and us-east-2), Canada (ca-central-1) and Ireland (eu-west-1), and the public website.

Why a vendor would switch itself off

The trigger was the PHP emergency release fixing two flaws that let an attacker who is not logged in run code on servers using PHP for web requests. For a system holding employee records, bank details and pay data, taking the application down until it was patched was the cautious choice, and BambooHR has not said it saw any attack. HRD, which covered the outage, notes that it hit some customers mid pay cycle.

What HR and payroll teams can take from it

The episode is a test of what happens when a cloud HR system is unavailable on a pay day. HRD suggests options such as rerunning the last approved payroll through the bank or paying a fixed amount and correcting it later, and checking local deadlines for paying wages, since a late payment can breach employment law even when a supplier caused it. Staff should also be told to ignore any email claiming to be from BambooHR that asks them to re-enter bank or login details, the usual follow-on to a well-publicised outage. Our payroll software category lists 13 products and our HR analytics software category 15.

Company profile on TrustList: BambooHR

Related on TrustList:

• India raises the EPFO wage ceiling to Rs 25,000 a month: employees earning Rs 15,000 to 25,000 now come under mandatory PF
• Singapore asks for 6% to 8% raises for lower-wage workers from December
• Hong Kong starts MPF Full Portability for newer staff on 21 December

Sources

• BambooHR status: BambooHR Temporarily Unavailable: Security Precaution, 21 October 2026
• HRD (HCAmag): Major HR system goes offline as critical cyber flaw drives wave of global shutdowns, 21 October 2026