AO3 offline up to 4 weeks after security incident
Original: Fan-fiction site Archive of Our Own (AO3) could be offline for up to 4 weeks after security incident
Why This Matters
AO3 hosts millions of works; extended downtime affects a large, active creative community.
Fan-fiction site Archive of Our Own (AO3) went offline after a security incident on Oct. 29, 2026. Operator OTW estimates 2–4 weeks downtime; user data exposure, including emails and hashed passwords, has not been ruled out.
Archive of Our Own (AO3), the nonprofit fan-fiction platform run by the Organization for Transformative Works (OTW), went down on October 29, 2026, following what was initially described as routine maintenance. Hours later, OTW confirmed a security incident. 'We are still in the early stages of response to this security incident and determining its scope,' the statement read. Restoration is estimated at two weeks but could stretch to four. OTW said it does not currently believe the user database was stolen, but cannot rule it out. That database includes usernames, email addresses, IP addresses, and hashed passwords. As a precaution, users are advised to change passwords on any other sites where they reused the same credentials. The site's status posts drew millions of views within two hours of the announcement. Some users speculated the outage was tied to 'PHP Armageddon'—two critical flaws in PHP uncovered last week via OpenAI and Google Wiz tools. AO3, however, runs on Ruby on Rails, not PHP, making that connection unlikely. OTW did not respond to media requests for comment.