The Signpost

File:Eisenia_foetida_R.H._(8).JPG
Rob Hille
cc-by-sa-3.0
395
News and notes

Security testing unleashes computer worm on Meta-wiki

Wikimedia sites locked to editing after security testing went awry

TKTK
Site status screen during March Wikimedia incident, showing zero edits on English Wikipedia
TKTK
Screenshot of the test edit in which a WMF employee accidentally loaded a malicious script from Ololoshka562's user space
screenshot of Meta-Wiki's recent changes feed showing many edits posting a strange message
Recent changes on Meta-Wiki show user accounts with advanced permission posting the message "Закрываем проект", which is Russian for "closing the project".

From approximately 16:00 UTC until 17:00 UTC on March 5, Wikimedia sites including English Wikipedia were put into read-only mode by site administrators in response to an incident in which Wikimedia user accounts with advanced permissions were seen on Meta-Wiki to post the message, "Закрываем проект" (Russian for "[we are] closing the project") on many pages, and in the edit summary of their post. During the shutdown, users monitoring Recent changes page on Meta could view WMF operators manually reverting what appeared to be a computer worm propagated in common.js, while other operators with compromised accounts continued to post the message.

As all the Wikimedia wikis were closed to editing, users took to Wikimedia channels including Discord and Telegram to discuss the situation. Community members speculated about the cause, expressing fear and anxiety that the incident was a government attack related to any of the military conflicts in which the United States is currently engaged, and a readiness to believe that Wikipedia was a suitable target for any government wanting to attack access to information.

The lead of the WMF's Product Safety and Integrity team stated

We have no reason to believe any third-party entity was actively attacking us today, or that any permanent damage occurred or any breach of personal information.
— User:EMill-WMF, in Wikipedia Discord #general

The Wikimedia Foundation described the incident at "March 2026 User Script Incident" on Meta-wiki, explaining that it happened while "Wikimedia Foundation staff were conducting a security review of user-authored code across Wikimedia projects." The talk page there is the place for anyone to raise further questions, share comments, and link to any discussions or coordination which follows this incident. As summarized in less technical terms by a community member:


The cleanup did not involve a database rollback, i.e. there were no lost edits due to the incident (not including edits that were never made because of the outage).

Russian Wikinews published an article on the incident. English Wikipedia editors posted the incident to Wikipedia:Village Stocks, a joke page where major blunders like accidentally deleting the Main Page are recorded both for educative purpose and lolz. Opinions are divided on whether it should be featured there. – B, H, Br

Wikimedia Foundation schedules erasure of 233GB of Wikimedia community notes in April 2026

English Wikipedia is about 22GB without images, visualized here as books. The Wikimedia Foundation Site Reliability Team just reported that we have 10x this much text in etherpad.wikimedia.org.

The Wikimedia Foundation has announced that it will delete all notes in the Wikimedia-hosted Etherpad instances at https://etherpad.wikimedia.org/ in April 2026. Since the adoption and recommendation of etherpads as a Wikimedia community notetaking platform in 2011, the Wikimedia community has used etherpads for notetaking during meetings of Wikimedia chapters and usergroups, Wikimedia conferences, and informal in-person or virtual meetings where community members have live voice conversations. As of Friday March 6, a Wikimedia volunteer rescue effort has backed up many etherpad notes linked from the most popular Wikimedia wikis in Wikimedia Toolforge, but the completeness of note preservation is uncertain.

The Site Reliability Engineering team of the Wikimedia Foundation communicated the decision in Wikimedia Phabricator ticket T415237 on January 22, framing the issue as a technical matter. On 10 February 2026, the Wikimedia Foundation made an announcement to Wikitech-l sharing that the Wikimedia Foundation will delete all the texts on 30 April 2026. The primary rationale for deletion is that this collection uses excessive resources. There is something odd here, as the filesize of Wikimedia etherpads is 233GB, which is about ten times the Wikipedia:Size of Wikipedia. Some of this content is the expected and familiar hand-typed notes from hard-working Wikimedia volunteer note takers, and the other 232GB is probably something unexpected.

Wikimedia technical editor and volunteer Audiodude communicated the matter to the Wikimedia community in venues including the Etherpad talk page and the Village Pump (miscellaneous).

While Wikimedia Foundation system administrators tend to start conversations as technical issues, Wikimedia users tend to think of software in terms of tools for achieving goals. While it may be the case that the etherpads are consuming more resources than anticipated, the point of the etherpads is to value and preserve discussion notes on important Wikimedia community volunteer concerns for user governance, strategic planning, and addressing the challenges we face in supporting global coordination of Wikimedia content development programs. The Wikimedia Foundation for years has recommended etherpad usage for event documentation, including at Wikimedia conferences including Wikimania, in discussions with Wikimedia Foundation staff and Wikimedia Foundation board members, and as a default notetaking service in all situations where notes can be public and collaboratively edited.

Looking ahead to deletion and to remember sample Wikimedia etherpad use, here are screenshots of typical notes documents, archived as PDFs in Wikimedia Commons. – BR

WP:NOMOREARCHIVETODAY (Archive.today is deprecated)

See related Signpost content in this issue's In the media and Technology report

Archive.today has been deprecated as the result of the Archive.is Request for Comment (5) (RfC 5) which closed 20 February. The RfC closure begins with the following text:

There is consensus to immediately deprecate archive.today, and, as soon as practicable, add it to the spam blacklist (or create an edit filter that blocks adding new links), and remove all links to it. There is a strong consensus that Wikipedia should not direct its readers towards a website that hijacks users' computers to run a DDoS attack.

Further information on the decision and practical outcomes for editors can be found at WP:Archive.today guidance. – B

Iranians need news

Three Iranians have stopped by Talk:Timeline of the 2026 Iran war thanking Wikipedians for providing news in the article that is otherwise unavailable. Communications and access to the normal news sources are down or blocked within Iran, but surprisingly enWiki is getting through. The requests for more news were also taken to The village pump. Editors have been advised to make sure to follow WP:Verifiability and WP:Reliable sources.

Brief notes

+ Add a comment

Discuss this story

These comments are automatically transcluded from this article's talk page. To follow comments, add the page to your watchlist. If your comment has not appeared here, you can try purging the cache.

Wikimedia Foundation schedules erasure of 233GB of Wikimedia community notes in April 2026

While I agree that there is a lot of valuable information that would be lost if all these etherpads were deleted without substitute, the comparison here seems misguided:

There is something odd here, as the filesize of Wikimedia etherpads is 233GB, which is about ten times the Wikipedia:Size of Wikipedia. Some of this content is the expected and familiar hand-typed notes from hard-working Wikimedia volunteer note takers, and the other 232GB is probably something unexpected.

It seems that the Signpost story's author may have overlooked the fact that Etherpad Lite stores very detailed history information too. (To take a concrete example of a pad recently used for the Signpost's own purposes, this pad takes up 23.2MB when exported as .etherpad file, but only 714kB when exported as HTML file which doesn't preserve history. The internal database representation probably differs a bit from that .etherpad export format in its space requirements, but in any case Wikipedia's full history dumps would have been a more appropriate - if still imperfect - comparison point.)

Regards, HaeB (talk) 04:29, 10 March 2026 (UTC)[reply]

÷


















Wikipedia:Wikipedia Signpost/2026-03-10/News_and_notes