The information below is on the wiki at IFWiki:September 2026 security incident , and will be emailed to users this weekend.
On 26 September 2026 the wiki server was hacked. This was within a few hours of a security vulnerability in the External Data extension being published ( CVE-2026-100382 ). We use that extension to allow our game pages to display some information directly from IFDB .
We restored the wiki from a 20 September 2026 snapshot, imported all subsequent page edits, updated the relevant extension, and changed all credentials. Nothing has been lost.
The hackers targeted credentials, by reading the configuration file and searching specifically for many keys like AWS, SES, Stripe, Mailgun etc. No interest was shown in the wiki itself: no defacement, content changes or database dumping.
However, to err on the side of caution, we will require every user to set a new password before logging in. This can be done at Special:PasswordReset , which will email you a reset link. Those who registered without an email address, or have since changed email address, can us (see IFWiki: ). If you used your old password on any other site, change it there too.
We hope that, when you visit the wiki, you will spend some time reading and will also consider editing some pages.
IFWiki team Interactive Fiction Technology Foundation
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
