Wikimedia Foundation
March 5, 2026
•[ JavaScript worm, script injection, vandalism ]
A self-propagating JavaScript worm modified user scripts and vandalized Meta-Wiki pages, triggering automated edits that injected hidden scripts and disruptive content. Wikimedia engineers temporarily restricted editing across projects during investigation and cleanup, then reverted malicious changes and restored editing. Reporting indicated nearly 4,000 pages were modified and about 85 users had their common.js files replaced during the incident.
