Story perspectives

Wikimedia Foundation Battles JavaScript Worm Vandalism Incident

3/10/2026

Summary

Story summary

The Wikimedia Foundation faced a security incident involving a self-propagating JavaScript worm that vandalized pages across multiple wikis, including Wikipedia, after being uploaded to Russian Wikipedia in March 2024 and remaining dormant until activated by a security engineer's routine review.
The worm modified approximately 3,996 pages and deleted content for nearly 30 minutes before being contained, with no personal data exposed.
The incident exposed a failure in the review process, as unvetted scripts were loaded without proper safeguards.
The Wikimedia Foundation is implementing additional security measures.

1 of 1

Story summary

The Wikimedia Foundation faced a security incident involving a self-propagating JavaScript worm that vandalized pages across multiple wikis, including Wikipedia, after being uploaded to Russian Wikipedia in March 2024 and remaining dormant until activated by a security engineer's routine review.
The worm modified approximately 3,996 pages and deleted content for nearly 30 minutes before being contained, with no personal data exposed.
The incident exposed a failure in the review process, as unvetted scripts were loaded without proper safeguards.
The Wikimedia Foundation is implementing additional security measures.