IFWiki: September 2026 security incident

General IF Community Resources
1

The information below is on the wiki at IFWiki:September 2026 security incident, and will be emailed to users this weekend.

On 26 September 2026 the wiki server was hacked. This was within a few hours of a security vulnerability in the External Data extension being published (CVE-2026-100382). We use that extension to allow our game pages to display some information directly from IFDB.

We restored the wiki from a 20 September 2026 snapshot, imported all subsequent page edits, updated the relevant extension, and changed all credentials. Nothing has been lost.

The hackers targeted credentials, by reading the configuration file and searching specifically for many keys like AWS, SES, Stripe, Mailgun etc. No interest was shown in the wiki itself: no defacement, content changes or database dumping.

However, to err on the side of caution, we will require every user to set a new password before logging in. This can be done at Special:PasswordReset, which will email you a reset link. Those who registered without an email address, or have since changed email address, can contact us (see IFWiki:Contact). If you used your old password on any other site, change it there too.

We hope that, when you visit the wiki, you will spend some time reading and will also consider editing some pages.

Best wishes

IFWiki team
Interactive Fiction Technology Foundation

2

Did the hackers gain my username and password to log in as me?

3

Definitely not. That didn’t happen to anybody. Only two people logged into the wiki during the period of the hack. One was me, and the other was a different user making genuine edits.

4

Good thing my security settings were loose. Could have sworn I’d changed my e-mail address a while ago, but as it turns out that was here on the forum. Note to self: keep better track of what e-mail address is being used on what site.