Self-Propagating JavaScript Worm Vandalized Wikimedia’s Meta-Wiki

Summary

Dormant JavaScript code activated during a Wikimedia security review spread through editor scripts and vandalized Meta-Wiki. Editing was temporarily disabled; the Foundation said the code was active for 23 minutes and no personal information breach was evident.

Key points

• The Wikimedia Foundation said staff activated dormant malicious user-authored code during a security review; it was active for 23 minutes.
• BleepingComputer's analysis found the worm injected loaders into user common.js files and the global MediaWiki:Common.js, using editor privileges to spread.
• BleepingComputer estimated about 3,996 pages were modified and around 85 users' common.js files replaced; the Foundation said the code changed and deleted content on Meta-Wiki only.
• Wikimedia temporarily disabled editing across projects while removing the code and reverting changes; editing resumed after cleanup.
• The Foundation said the affected content was being restored, there was no permanent damage, and it had no evidence of a personal information breach.
• A detailed post-incident report explaining how the dormant code was activated and the worm's full spread had not yet been published.

Products

Related Articles

• PHP2Shell PoCs Proliferate as Patching Lags and Exploit Reports Conflictdatabreachtoday.comMediaWiki
• Malicious GitHub Workflows Exfiltrated Credentials From 772 RepositoriesHak5Wikipedia
• AI Reports Strain Bug Bounties as IoT Malware and AI Agents Raise Security ConcernsIBM TechnologyWikipedia