[Mediawiki-l] Malicious content deleting bots

[Mike Wheeler]

I too have noticed what appear to be malicious bots deleting content  
from wikis over the past couple days.

 From what I have seen they delete page content starting at the first  
ampersand through the end of the page.

Here is one page they hit:

http://www.archiplanet.org/w/index.php? 
title=Notre_Dame_Cathedral&diff=550682&oldid=547840

I have seen this on multiple unrelated wikis which do not require  
registration for editing. In the above case it was done by a newly  
registered user with a six character alphanumeric username, as  
described by the first person to report this on the list. Other  
instances have been done by unregistered users recorded only by IP  
number:

http://www.archiplanet.org/w/index.php? 
title=Gunter_Behnisch&diff=550666&oldid=548133

Thankfully they have only hit a few of our pages so far, but we would  
obviously like to put an end to it before they do more widespread  
damage.

Mike