Jump to content

Incidents/2026-10-21 PHP security update/Community

From Wikitech

We are undertaking critical maintenance work due to an updated PHP release. Events are developing rapidly. This page will be updated as appropriate.

  • This page was last edited at 2026-10-30T18:39:59 (UTC).

Availability of Wikimedia services

We have taken certain services down as a precautionary measure while we apply the patches.

The following services have been partially restored:

  • Cloud VPS (*.wmcloud.org, *.wmflabs.org. sites)
    • Most Cloud VPS projects have been re-enabled, but some remain offline pending upgrade work done by their maintainers.
    • Maintainers are being let back into their projects to upgrade the PHP versions themselves. We are contacting each project's maintainers via email with instructions.
  • Toolforge (*.toolforge.org sites)
    • Non-PHP tools are now accessible, but some may need to be restarted.
    • PHP 8.2 and 8.4 pre-built patched images are available. Build Service support for PHP versions (>= 8.2.35, 8.3.36, 8.4.27 or 8.5.12) using the heroku/php (default) builder is available, other PHP package installs are still blocked.
    • All tools using PHP 7.4 or older must upgrade to a newer version. A list of Toolforge tools needing PHP upgrades by their maintainers is available.

The following services have been fully restored:

Updates and guidance

FAQs

Last updated 2026-10-29 15:00 UTC

What was the plan for bringing Toolforge services back online?

We've taken a phased approach, where we brought things back as we managed to do so with as much safety as possible. Restoring wider platform functionality is our main focus, while we try to slowly enable more and more tools to be brought back online.

First, we've managed to bring back partial platform functionality and enabled non-PHP tools – both jobs and webservices. Some of these might still require adjustments or a restart from a maintainer.

Next, services using patched php versions via pre-built images and buildservice based images were made safe to run (maintainers might have to rebuild the respective buildservice image if it had the unpatched php image).

Last, but not least, for tools that rely on unfixed/unfixable PHP versions (<php8), we are asking maintainers to upgrade to a newer version with patches available. A list of tools that are blocked by this can be found here.

What is the plan for bringing Cloud VPS services back online?

Due to the diverse nature of Cloud VPS projects and the technologies they use, we are taking a more careful approach, where we look at them individually and figure out which ones are clear of PHP usage before they can be brought back up. Our first priority was bringing projects critical to WMF infrastructure – we've accomplished most of this.

Next, we've picked up projects by WMF staff and/or NDA users, since we have more flexibility to adjust those projects to our current safety standards. We brought back up the ones that don't use PHP at all, or attempted to upgrade and fix the ones we could.

After that we've started looking at patching remaining projects that use patchable versions of PHP in some form – we've done so to the best of our ability and understanding of each project, with a focus on security rather than fully enabled functionality at first.

Last but not least, we are facing up to the projects that rely on unfixed PHP versions. This will likely take a few days for most projects which have a simpler path to safety, and a few weeks for the most complex ones. We are in contact with the respective maintainers for support as we start working together on their projects.

An outline of the status of projects can be found here.

What do I need to do to get my tool or project back online?

  • Toolforge-hosted non-PHP tools: Most non-PHP tools should be back online. Some webservices will require a restart to be fully functional.
  • Toolforge-hosted tools that contain PHP code: You need to check if your tool is compatible with newer version of PHP. You can try to restart it. Further informations are on talk page.
  • Cloud VPS project: We have been contacting project maintainers for support as needed once we start working on their projects. We appreciate your timely response so we can get things up and running quickly.

Where can I share my input about tools that could/should be brought back online?

We're rather focused on broader platform functionality and supporting our phased, safety-first approach to restoring most of Toolforge and Cloud VPS to everyone.

Of course, we understand that certain tools are crucial to support important workflows in the community (e.g. vandalism detection) and you'd like to see them prioritized if possible. We also know that there are tools that might still be offline even though they are seemingly safe (don't use PHP at all), and furthermore, there are tools for which the respective maintainers are also available to make safe (i.e. upgrade) once we enable them to do so.

If you'd like to flag any of the cases above, we welcome your input through this Wikitech talk page. While we can't guarantee when we'll be able to use this information, other technical community members might be able to support, and we appreciate your effort in signaling all of these cases to us.

Where should I go if I have additional questions?

If you have questions for the WMCS admins, please contact them through IRC or the bridged Telegram group. Phabricator issues are also welcome for more complex issues. All other questions can be shared through this Wikitech talk page.

Other channels, such as Discord, while not actively monitored by WMCS admins, may still contain helpful and context-aware community members and other WMF staff, who can help with general questions about the ongoing situation of WMCS.

Retrieved from "https://wikitech.wikimedia.org/w/index.php?title=Incidents/2026-10-21_PHP_security_update/Community&oldid=2475798"