Important Notice: Bullhorn and PHP

PHP

You may have seen news this week about two critical PHP vulnerabilities (known as "PHP2Shell", CVE-2026-109618 and CVE-2026-109619) affecting websites worldwide. We want to let you know where Shazamme stands.

Your website is not affected. Your career website is not built on PHP and was not impacted by these vulnerabilities.

1. Patched: The one background component of our platform that uses PHP has been upgraded to the official fixed release (PHP 8.5.12), applied within hours of the fix being published.

2. Protected before the fix: Our platform sits behind Cloudflare's web application firewall (WAF). Cloudflare deployed rules against these vulnerabilities, so known attack patterns were being blocked while the patch was rolled out.

3. No signs of attack: We have reviewed our logs and found no requests matching the known attack patterns against Shazamme systems.

4. Prevention in place: As an ISO 27001-certified business, we run formal vulnerability management, monitoring and incident response processes, which is how we identified, prioritised and resolved this quickly.

What this means for you: no action is needed. Your website, your candidate data and your Shazamme services continue to run as normal.

If your security or IT team would like more detail, just reply to this email and we'll be happy to help.

Bullhorn

BH has been communicating with us and have shared this link with us.

In summary:
Shazamme has 100s of BH customers and we need all customer credentials updated at the same time as we had to disable the outbound queue as this keeps growing in size with 10000's of applications.

Unfortunately we can not cherry pick customers as the queue contains all customers.

We communicate with BH multiple times a day via email and telephone and the message is loud and clear that we need to wait until they get to our ticket.