Wikimedia Foundation has announced it will skip its weekly MediaWiki software release following emergency security patching for PHP that disrupted deployment schedules. The revised plan consolidates two weeks of changes into a single software branch scheduled for November 3, according to the foundation's release engineering team.
The delay comes amid a slower-than-expected recovery across volunteer computing services, despite emergency fixes issued for four PHP branches on October 21. Installing these fixes across independently managed projects requires additional verification before services can be fully restored. Patching the runtime is only the first step, the foundation noted.
Wikimedia's shared cloud infrastructure means that a vulnerable project can pose a threat to others, while maintainers retain control over the software within their own virtual machines. As a result, staff cannot centrally guarantee that every installation has been updated. Affected services include tools used for anti-abuse work.
As of October 25, wiki reading and editing are operational, but other services remain partially degraded. Toolforge PHP 8.4 images have been patched and re-enabled, and PHP buildpacks are available for supported patched versions. Cloud VPS is undergoing individual project checks and upgrades, with PAWS and Quarry targeted for early next week.
Cloud Services engineer David Caro reported that patched PHP 8.4 images were available on October 23, followed by PHP buildpacks. Tools Platform engineering manager Arthur Reis Puthin confirmed the reopening for supported patched versions, and noted progress restoring Cloud VPS where upgrades were straightforward. More complex projects require maintainer assistance, and staff have begun allowing some owners back in to perform upgrades themselves.
The release engineering team has outlined a staged rollout. The wmf.1 branch will be deployed to an initial test group on October 28, then to most non-Wikipedia wikis on October 29, and finally to all wikis. The wmf.2 branch is skipped, and the wmf.3 branch on November 3 will contain two weeks of changes.
These branch numbers refer to application releases, while PHP is the underlying interpreter with its own security update requirements. The plan separates restoring the deployment pipeline from repairing volunteer applications. PHP's October 21 security advisory lists four versions that fix two original flaws: PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Older installations may need a vendor backport or migration to a supported branch.
A separate October 23 advisory details another code-execution risk in applications that change their session serializer at runtime while session upload progress is enabled. PHP recommends disabling session upload progress until the next regular bugfix release, noting the combination is unlikely in practice. CERT-EU updated its advisory on October 23 to include this third vulnerability, CVE-2026-115560, which will be addressed through the regular release cycle.
Wikimedia plans to provide more Cloud VPS instructions on Monday, October 26, including information on affected projects. The update should identify the work owners still need to complete before their projects can restart. The next application deployment targets are October 28 and 29, followed by the November 3 branch.
