Bullhorn Incident Updates - All Products

Update timeline

1. investigating Oct 20, 2026, 05:15 PM UTC

   [1:15 PM EST 10/20/2026] As we continue our response to the Bullhorn Platform security incident, please be vigilant against potential social engineering attacks. Threat actors may pose as Bullhorn personnel via email, text, or phone calls, using the incident as a pretext to request credentials or sensitive information. Please note that Bullhorn will never ask you to share your password, Multi-Factor Authentication (MFA) codes, or verification tokens via email, telephone, text, or any other channel. All regions are now online and we are continuing to monitor. Updates and Status on the Known Issues and App Integrations, as well as our FAQ, can be found below. Fixes have been implemented for the following: - SSO access from the ATS to external applications and Bullhorn applications has been restored for the US. Other regions are being worked on. - SSO customers who were experiencing challenges previously are asked to test again and log a ticket via support if issues persist. - Bullhorn owned customizations across all regions are also in the process of being brought online. - Ability for ATS Admins to edit users and manually set passwords has been restored in the application. For a comprehensive list, please see our Known and Resolved Issues and Integrated App Status. Please find the FAQ here.

2. investigating Oct 20, 2026, 09:24 PM UTC

   [5:23 PM EST 10/20/2026] As we continue our response to the Bullhorn Platform security incident, please be vigilant against potential social engineering attacks. Threat actors may pose as Bullhorn personnel via email, text, or phone calls, using the incident as a pretext to request credentials or sensitive information. Please note that Bullhorn will never ask you to share your password, Multi-Factor Authentication (MFA) codes, or verification tokens via email, telephone, text, or any other channel. All regions are now online and we are continuing to monitor. Fixes have been implemented for the following: - SSO access from the ATS to external applications and Bullhorn applications has been restored for the US. Other regions are being worked on. - SSO customers who were experiencing challenges previously are asked to test again and log a ticket via support if issues persist. - Bullhorn owned customizations across all regions are also in the process of being brought online. - Ability for ATS Admins to edit users and manually set passwords has been restored in the application. For a comprehensive list, please see our Known and Resolved Issues and Integrated App Status. Please find the FAQ here.

3. investigating Oct 21, 2026, 02:32 AM UTC

   [10:32 PM EST 10/20/2026] As we continue our response to the Bullhorn Platform security incident, please be vigilant against potential social engineering attacks. Threat actors may pose as Bullhorn personnel via email, text, or phone calls, using the incident as a pretext to request credentials or sensitive information. Please note that Bullhorn will never ask you to share your password, Multi-Factor Authentication (MFA) codes, or verification tokens via email, telephone, text, or any other channel. We are restoring user access to Bullhorn ATS/CRM across the APAC region, and some users have already regained access. However, restoring access for all users will take time. Organizations should expect continued disruption throughout today’s workday. The time required is due to the restoration process itself and is not related to the cybersecurity event reported earlier this week. What you should do: - Do not attempt to change your password. Doing so will delay the restoration of your access. - Try logging in approximately every 30 minutes to check whether your access has been restored. Our teams are working around the clock and will provide further updates as access is restored. All other regions are now online and we are continuing to monitor. Fixes have been implemented for the following: - SSO access from the ATS to external applications and Bullhorn applications has been restored for the US. Other regions are being worked on. - SSO customers who were experiencing challenges previously are asked to test again and log a ticket via support if issues persist. - Bullhorn owned customizations across all regions are also in the process of being brought online. For a comprehensive list, please see our Known and Resolved Issues and Integrated App Status. Please find the FAQ here.

4. investigating Oct 21, 2026, 09:02 AM UTC

   [05:00 AM EST 10/21/2026] As we continue our response to the Bullhorn Platform security incident, please be vigilant against potential social engineering attacks. Threat actors may pose as Bullhorn personnel via email, text, or phone calls, using the incident as a pretext to request credentials or sensitive information. Please note that Bullhorn will never ask you to share your password, Multi-Factor Authentication (MFA) codes, or verification tokens via email, telephone, text, or any other channel. We are restoring user access to Bullhorn ATS/CRM across the APAC region, and some users have already regained access. However, restoring access for all users will take time. Organizations should expect continued disruption throughout today’s workday. The time required is due to the restoration process itself and is not related to the cybersecurity event reported earlier this week. What you should do: - Do not attempt to change your password. Doing so will delay the restoration of your access. - Try logging in approximately every 30 minutes to check whether your access has been restored. Our teams are working around the clock and will provide further updates as access is restored. All other regions are now online and we are continuing to monitor. Fixes have been implemented for the following: - SSO access from the ATS to external applications and Bullhorn applications has been restored for the US. Other regions are being worked on. - SSO customers who were experiencing challenges previously are asked to test again and log a ticket via support if issues persist. - Bullhorn owned customizations across all regions are also in the process of being brought online. For a comprehensive list, please see our Known and Resolved Issues and Integrated App Status. Please find the FAQ here.

5. investigating Oct 21, 2026, 12:52 PM UTC

   We are continuing to investigate this issue.

6. investigating Oct 21, 2026, 01:00 PM UTC

   Status Update: Service Disruptions and Cybersecurity Precautions We want to provide clarity on three separate events impacting Bullhorn, our customers, and websites worldwide. Worldwide PHP Vulnerabilities – Affected Services Offline Today, critical vulnerabilities were disclosed in PHP, software widely used to power websites and applications around the world, including some of Bullhorn's solutions. Cybersecurity authorities have advised taking all PHP websites offline until a patch is available. To protect your data and systems, we are taking affected services offline until the necessary patches are available and applied. The following Bullhorn products are impacted: - Talent Platform - BBO - FastForward (connexys.nl) - Market IQ - Target Recruit - SourceBreaker - Bond APAC Job Portal - Akyla October 17 Cyber Incident – Remains Contained PHP’s incident is unrelated to our cyber incident. The cyber incident remains contained; we have detected no additional activity since our Oct 17 announcement. We have cybersecurity experts from CrowdStrike and Kroll working with our teams around the clock to monitor our systems. Global Database Replication Issue – Separate Operational Incident The login delays that impacted APAC earlier today are a database replication issue that is now impacting some customers globally. It was an operational issue unrelated to the cyber incident. The issue is intermittent and continues to impact some customers. A full incident report will follow.

7. investigating Oct 21, 2026, 03:01 PM UTC

   [11:00 AM EST 10/21/2026]Status Update: Service Disruptions and Cybersecurity Precautions We want to provide clarity on three separate events impacting Bullhorn, our customers, and websites worldwide. Worldwide PHP Vulnerabilities – Affected Services Offline Today, critical vulnerabilities were disclosed in PHP, software widely used to power websites and applications around the world, including some of Bullhorn's solutions. Cybersecurity authorities have advised taking all PHP websites offline until a patch is available. To protect your data and systems, we are taking affected services offline until the necessary patches are available and applied. The following Bullhorn products are impacted: - Talent Platform - BBO - FastForward - Market IQ - Target Recruit - SourceBreaker - Bond APAC Job Portal - Akyla The PHP issue does not impact Bullhorn ATS/CRM, Bullhorn Recruitment Cloud, eRecruit, Onboarding365, Bullhorn Time & Expense, Bullhorn Automation, Textkernel, connexys, Bond Adapt UK & US or VMS Sync. October 17 Cyber Incident – Remains Contained PHP’s incident is unrelated to our cyber incident. The cyber incident remains contained; we have detected no additional activity since our Oct 17 announcement. We have cybersecurity experts from CrowdStrike and Kroll working with our teams around the clock to monitor our systems. Global Database Replication Issue – Separate Operational Incident Earlier today, some customers in APAC had trouble logging in. This is now affecting some customers in other regions too. The cause is the volume of account changes from the new security steps, including multi-factor authentication setup and password updates. With so many people updating their accounts at once, our systems are taking longer than usual to sync those changes across our systems. That delay is what’s causing slow or failed logins. We expect this one time synchronization process to be completed within a few hours." For a comprehensive list, please see our Known and Resolved Issues and Integrated App Status. Please find the FAQ here.

8. investigating Oct 21, 2026, 03:58 PM UTC

   [12:00 PM EST 10/21/2026]Status Update: Service Disruptions and Cybersecurity Precautions We want to provide clarity on three separate events impacting Bullhorn, our customers, and websites worldwide. Worldwide PHP Vulnerabilities – Affected Services Offline Today, critical vulnerabilities were disclosed in PHP, software widely used to power websites and applications around the world, including some of Bullhorn's solutions. Cybersecurity authorities have advised taking all PHP websites offline until a patch is available. To protect your data and systems, we are taking affected services offline until the necessary patches are available and applied. The following Bullhorn products are impacted: - Talent Platform - BBO - FastForward - Market IQ - Target Recruit - SourceBreaker - Bond APAC Job Portal - Akyla The PHP issue does not impact Bullhorn ATS/CRM, Bullhorn Recruitment Cloud, eRecruit, Onboarding365, Bullhorn Time & Expense, Bullhorn Automation, Textkernel, connexys, Bond Adapt UK & US or VMS Sync. October 17 Cyber Incident – Remains Contained PHP’s incident is unrelated to our cyber incident. The cyber incident remains contained; we have detected no additional activity since our Oct 17 announcement. We have cybersecurity experts from CrowdStrike and Kroll working with our teams around the clock to monitor our systems. Global Database Replication Issue – Separate Operational Incident Earlier today, some customers in APAC had trouble logging in. This is now affecting some customers in other regions too. The cause is the volume of account changes from the new security steps, including multi-factor authentication setup and password updates. With so many people updating their accounts at once, our systems are taking longer than usual to sync those changes across our systems. That delay is what’s causing slow or failed logins. We expect this one time synchronization process to be completed within a few hours." For a comprehensive list, please see our Known and Resolved Issues and Integrated App Status. Please find the FAQ here.

9. investigating Oct 21, 2026, 08:40 PM UTC

   [4:40 PM EST 10/21/2026] Status Update: Service Disruptions and Cybersecurity Precautions We want to provide clarity on three separate events impacting Bullhorn, our customers, and websites worldwide. Worldwide PHP Vulnerabilities – Affected Services Offline Today, critical vulnerabilities were disclosed in PHP, software widely used to power websites and applications around the world, including some of Bullhorn's solutions. Cybersecurity authorities have advised taking all PHP websites offline until a patch is available. To protect your data and systems, we are taking affected services offline until the necessary patches are available and applied. The following Bullhorn products are impacted: - Talent Platform: Expected to be available today - BBO - Target Recruit - SourceBreaker: Expected to be available today - Bond APAC Job Portal The following Bullhorn products have had the necessary patches applied: - FastForward - Market IQ - Akyla The PHP issue does not impact Bullhorn ATS/CRM, Bullhorn Recruitment Cloud, eRecruit, Onboarding365, Bullhorn Time & Expense, Bullhorn Automation, Textkernel, connexys, Bond Adapt UK & US or VMS Sync. October 17 Cyber Incident – Remains Contained PHP’s incident is unrelated to our cyber incident. The cyber incident remains contained; we have detected no additional activity since our Oct 17 announcement. We have cybersecurity experts from CrowdStrike and Kroll working with our teams around the clock to monitor our systems. Global Database Replication Issue – Separate Operational Incident Some customers had trouble logging into the Bullhorn ATS. The cause was the volume of account changes from the new security steps, including multi-factor authentication setup and password updates. With so many people updating their accounts at once, our systems were taking longer than usual to sync those changes across our systems. That delay caused slow or failed logins and the synchronization process is now caught up. For a comprehensive list, please see our Known and Resolved Issues and Integrated App Status. Please find the FAQ here.

10. investigating Oct 22, 2026, 12:01 AM UTC

    [8:01 PM EST 10/21/2026] Status Update: Service Disruptions and Cybersecurity Precautions We want to provide clarity on three separate events impacting Bullhorn, our customers, and websites worldwide. Worldwide PHP Vulnerabilities – Affected Services Offline Today, critical vulnerabilities were disclosed in PHP, software widely used to power websites and applications around the world, including some of Bullhorn's solutions. Cybersecurity authorities have advised taking all PHP websites offline until a patch is available. To protect your data and systems, we are taking affected services offline until the necessary patches are available and applied. The following Bullhorn products are impacted: - Talent Platform - BBO - Target Recruit The following Bullhorn products are now available after addressing the PHP security requirements: - FastForward - Market IQ - Akyla - Sourcebreaker - Bond APAC Job Portal The PHP issue does not impact Bullhorn ATS/CRM, Bullhorn Recruitment Cloud, eRecruit, Onboarding365, Bullhorn Time & Expense, Bullhorn Automation, Textkernel, connexys, Bond Adapt UK & US or VMS Sync. October 17 Cyber Incident – Remains Contained PHP’s incident is unrelated to our cyber incident. The cyber incident remains contained; we have detected no additional activity since our Oct 17 announcement. We have cybersecurity experts from CrowdStrike and Kroll working with our teams around the clock to monitor our systems. Global Database Replication Issue – Separate Operational Incident Some customers had trouble logging into the Bullhorn ATS. The cause was the volume of account changes from the new security steps, including multi-factor authentication setup and password updates. With so many people updating their accounts at once, our systems were taking longer than usual to sync those changes across our systems. That delay caused slow or failed logins while the synchronization process catches up. Some users may still experience a password reset loop when attempting to log in. We will provide further updates on this issue as they become available. For a comprehensive list, please see our Known and Resolved Issues and Integrated App Status. Please find the FAQ here.

11. investigating Oct 22, 2026, 07:18 AM UTC

    We are continuing to investigate this issue.

12. investigating Oct 22, 2026, 10:15 AM UTC

    [09:00 AM EST 10/22/2026] Status Update: Service Disruptions and Cybersecurity Precautions We want to provide clarity on three separate events impacting Bullhorn, our customers, and websites worldwide. Worldwide PHP Vulnerabilities – Affected Services Offline Today, critical vulnerabilities were disclosed in PHP, software widely used to power websites and applications around the world, including some of Bullhorn's solutions. Cybersecurity authorities have advised taking all PHP websites offline until a patch is available. To protect your data and systems, we are taking affected services offline until the necessary patches are available and applied. The following Bullhorn products are impacted: - Talent Platform - BBO The following Bullhorn products are now available after addressing the PHP security requirements: - FastForward - Market IQ - Akyla - Sourcebreaker - Bond APAC Job Portal -Target Recruit The PHP issue does not impact Bullhorn ATS/CRM, Bullhorn Recruitment Cloud, eRecruit, Onboarding365, Bullhorn Time & Expense, Bullhorn Automation, Textkernel, connexys, Bond Adapt UK & US or VMS Sync. October 17 Cyber Incident – Remains Contained PHP’s incident is unrelated to our cyber incident. The cyber incident remains contained; we have detected no additional activity since our Oct 17 announcement. We have cybersecurity experts from CrowdStrike and Kroll working with our teams around the clock to monitor our systems. Global Database Replication Issue – Separate Operational Incident Some customers had trouble logging into the Bullhorn ATS. The cause was the volume of account changes from the new security steps, including multi-factor authentication setup and password updates. With so many people updating their accounts at once, our systems were taking longer than usual to sync those changes across our systems. That delay caused slow or failed logins while the synchronization process catches up. Some users may still experience a password reset loop when attempting to log in. We will provide further updates on this issue as they become available. For a comprehensive list, please see our Known and Resolved Issues and Integrated App Status. Please find the FAQ here.

13. investigating Oct 22, 2026, 03:21 PM UTC

    [11:20 AM EST 10/22/2026] Update on PHP Vulnerabilities and Service Restoration We want to provide an update on the recently disclosed vulnerabilities in PHP, software widely used to power approximately 70% of websites worldwide, and their impact on certain Bullhorn solutions. Issues Resolved for Most Impacted Solutions; Talent Platform and BBO Remain in Progress -These impacted solutions have had the issues resolved: FastForward, Market IQ, TargetRecruit, SourceBreaker, Bond APAC Job Portal, and Akyla. -These impacted solutions are still in progress: Talent Platform and BBO. Based on our current progress, we expect to have Talent Platform resolved shortly; however, we recommend that customers plan for BBO to remain unavailable through the end of this week. Many of the impacted solutions handle sensitive information and support business-critical processes, including payroll and onboarding. As a result, they are subject to rigorous security requirements, and the work required to validate their security before bringing them back online is more extensive and time-consuming than for other systems. Our teams are working diligently to complete the necessary security measures and testing so that we can restore these solutions with the highest level of confidence.

14. investigating Oct 22, 2026, 03:42 PM UTC

    [11:40 AM EST 10/22/2026] Update on PHP Vulnerabilities and Service Restoration We want to provide an update on the recently disclosed vulnerabilities in PHP, software widely used to power approximately 70% of websites worldwide, and their impact on certain Bullhorn solutions. Most Impacted Solutions Upgraded and Restored -Talent Platform access has been fully restored following yesterday’s maintenance. Customers can resume normal use. -Upgraded to address the vulnerabilities and fully available: Talent Platform, FastForward, Market IQ, TargetRecruit, SourceBreaker, Bond APAC Job Portal, and Akyla. -Upgrade in progress: BBO We recommend that customers plan for BBO to remain unavailable through the end of this week. We’ll share further updates as BBO work progresses. For a comprehensive list, please see our Known and Resolved Issues and Integrated App Status. Please find the FAQ here.

15. investigating Oct 23, 2026, 05:41 AM UTC

    [1:30 AM EST 10/23/2026] Update on PHP Vulnerabilities and Service Restoration We want to provide an update on the recently disclosed vulnerabilities in PHP, software widely used to power approximately 70% of websites worldwide, and their impact on certain Bullhorn solutions. Most Impacted Solutions Upgraded and Restored - Talent Platform access has been fully restored following yesterday’s maintenance. Customers can resume normal use. As Talent Platform comes back online, you may notice some temporary slowness, and some records may not be fully synced yet. The system is processing a large backlog of incoming ATS activity, and performance and data should return to normal as the backlog clears. - Upgraded to address the vulnerabilities and fully available: Talent Platform, FastForward, Market IQ, TargetRecruit, SourceBreaker, Bond APAC Job Portal, and Akyla. - Upgrade in progress: BBO We recommend that customers plan for BBO to remain unavailable through the end of this week. We’ll share further updates as BBO work progresses. For a comprehensive list, please see our Known and Resolved Issues and Integrated App Status. Please find the FAQ here.

16. investigating Oct 23, 2026, 02:02 PM UTC

    [10:00 AM EST 10/23/2026] Update on PHP Vulnerabilities and Service Restoration We want to provide an update on the recently disclosed vulnerabilities in PHP, software widely used to power approximately 70% of websites worldwide, and their impact on certain Bullhorn solutions. Most Impacted Solutions Upgraded and Restored - Access to BBO has been restored - Talent Platform access has been fully restored following yesterday’s maintenance. Customers can resume normal use. As Talent Platform comes back online, you may notice some temporary slowness, and some records may not be fully synced yet. The system is processing a large backlog of incoming ATS activity, and performance and data should return to normal as the backlog clears. - Upgraded to address the vulnerabilities and fully available: Talent Platform, FastForward, Market IQ, TargetRecruit, SourceBreaker, Bond APAC Job Portal, BBO and Akyla. For a comprehensive list, please see our Known and Resolved Issues and Integrated App Status. Please find the FAQ here.