Wikipedia hit by self-propagating JavaScript worm that vandalized pages

The Wikimedia Foundation was hit by a self‑propagating JavaScript worm that injected malicious loaders into both global (MediaWiki:Common.js) and user-level common.js files, vandalizing roughly 3,996 pages and replacing about 85 users' common.js scripts; engineers temporarily restricted editing, reverted changes, and removed the injected code. The dormant malicious test.js (hosted on Russian Wikipedia) appears to have been executed in a logged-in editor's browser, but it remains unclear whether that execution was intentional, accidental, or due to a compromised account.