Wikimedia says it is patching newly discovered security vulnerabilities in PHP, and it has taken some of its systems offline until the fixes are in.
A Wikimedia Foundation spokesperson tied the October 21 outage to the flaws, which are weaknesses an attacker could potentially exploit. PHP is the programming language that underpins most wikis, including Wikipedia, the spokesperson said. The issue "affects all known versions of PHP" and "is not specific to the Wikimedia Foundation," the spokesperson added. Both Foundation-supported systems and volunteer-run ones that use PHP are affected. Wikimedia's status page listed an unresolved incident labeled "Emergency Maintenance."
The Internet Archive, home of the Wayback Machine, went down the same morning. According to DownDetector, problems at both sites began around 10 or 11 a.m. ET. The Archive confirmed on X that it was having trouble, and its site returned a connection timeout error. The Archive has not given a cause. Wikipedia itself was still reachable at last check.
The detail worth noting is where the flaw sits. A bug in a company's own code is that company's problem to fix. A bug in the language underneath is everyone's, and the cleanup depends on patches landing and on each site operator applying them. That Wikimedia chose to take systems down, rather than leave them running while it patched, suggests it judged downtime the cheaper option. That is a judgment call the spokesperson described only as precautionary.
Whether the two outages share a cause is unanswered. Wikimedia's statement does not mention the Archive, and nothing the Archive has said links its problem to PHP. Until it explains, the overlap in timing is the only thing connecting them.