Hi everyone,
There was a security issue on a couple of wikias over the weekend. No long-term damage was done to any wikia, but a nasty troll caused some havoc for a while.
We know some accounts were compromised during this time. It's a small number, and only affected members of attacked wikias - those communities have been directly informed, but if you are at all concerned, you should change your password to be safe. You should also consider where else you use the same password and change it, just in case. (Note: We recommend never using the same password on different sites.)
We have taken immediate measures to ensure that the wikias, and your accounts, are safe. Including turning off custom JS on all wikias. We’ll look today, and over the coming days, at longer-term changes to increase security.
One request: Central is full of incredibly intelligent folk, who will have various ideas about what happened and what should be done about it. For now, please hold off speculation and explanations, and let us work in the background on this over the next few days. We will talk more about this in the future, either with a blog or forum post, or similar communication.
Thanks everyone, we'll follow up on this as soon as possible.
Edit 1: I have tried to answer the first wave of questions here. Custom wikia CSS has also been turned back on.
Edit 2: JavaScript will return tonight in read-only mode. Read more here.
Edit 3: The code changes have been completed and JavaScript & Verbatim have returned in read-only mode. Read more here.
Edit 4: We have re-enabled editing on some specific MediaWiki namespace pages: Common.css, Wikia.css, Monobook.css, Wiki-navigation, and Community-corner. We are continuing to work on expanding this list, along with other improvements.
Edit 5: An update on this topic focusing on the next steps has been posted in this thread.