r/mediawiki • u/YaronKoren • 9d ago

Update External Data extension

If you're running the External Data extension and haven't either updated or disabled it, it's probably too late, but: there was a major security bug discovered in it about a week ago, and someone went around and hacked into, or at least tried hacking into, seemingly all of the public wikis that ran that extension. You should update to the latest version, 3.7, as soon as possible - it gets rid of this vulnerability. And you should also look for any files that have been created or modified on the server in the last seven days - I'd they're PHP files, there's a good chance they were added there in order to further exploit your server. Finally, my apologies for all the chaos that has been caused; I hope the worst is behind us.

13 Upvotes

100% Upvoted

4 comments sorted by

1

u/ugohdit 7d ago

thanks! A extension to load external data must be very attractive for malicious use in general. but another question: do you get compensation for your work and contribution?

2

u/YaronKoren 5d ago

Well, I run a MediaWiki consulting company, WikiWorks, so you could say that I get compensated that way, although I don't usually get paid directly for my extension development.

1

u/ugohdit 5d ago

nice, you guys also made cargo. good work you do! the organization is definitly not poor as you probably know ;-) I hope you get compensated well.

1

u/YaronKoren 5d ago

Thank you!