On October 20, 2026, we took Wikimedia Cloud Services (WMCS) and other services offline as a precaution due to two significant vulnerabilities that were discovered in PHP, the programming language most of our services rely on. The PHP Foundation published an advisory ahead of the announcement due to the significance of these vulnerabilities.

Keeping the Wikimedia projects and their users secure and safe is our top priority. A significant amount of information on the Wikimedia projects is public and available for everyone, but our projects necessarily contain some personal information that is critical to keep private. Protecting user privacy is an essential part of free knowledge, and the Wikimedia Foundation Privacy Policy commits us to strive to keep non-public personal information secure.

During this incident, all versions of PHP required an immediate upgrade to protect our infrastructure from compromise and to protect user privacy.…