ASOS, a UK-based online fashion retailer, suffered a data breach caused by a social engineering attack where hackers stole an employee's login credentials. The attackers accessed certain third-party platforms used by ASOS, exposing some customers' basic personal information and contact details. Payment card information and account passwords were not accessed. ASOS confirmed the breach, locked down affected platforms, and is investigating with external experts and law enforcement. Customers were notified that no action is required on their accounts but were advised to be cautious of unsolicited messages. The company has implemented additional security measures to prevent similar incidents.
The Airwallex Online Payments Gateway WordPress plugin before 1.36.0 does not verify that an incoming payment notification genuinely comes from the payment provider when no webhook secret has been configured, allowing unauthenticated attackers to forge one and mark orders as paid without paying.
PINAKA CTF 2026 is a national-level Capture The Flag competition organized by the National Forensic Sciences University (NFSU), Chennai Campus. It features multiple cybersecurity challenge categories including web exploitation, digital forensics, OSINT, cryptography, reverse engineering, binary exploitation, network security, and steganography. The competition includes an online qualification round and an offline grand finale. This event is designed to test and enhance cybersecurity skills among students, professionals, and enthusiasts. There is no indication that this event represents a security threat or vulnerability.
Microsoft will block .msix and .msixbundle file attachments in Outlook Web and the new Outlook Windows client starting in November 2026. These file types, used for modern Windows installation packages, will be added to the default blocked attachments list in Exchange Online's OWA Mailbox policies. After the update, users will be unable to send, receive, open, or download these attachments by default. Administrators can whitelist these file types if necessary. This change is part of Microsoft's ongoing efforts to enhance security by blocking potentially unsafe file attachments that have been abused in attacks.
Southern Company has disclosed a data breach affecting approximately 400,000 customer accounts across its electric utilities Georgia Power, Alabama Power, and Mississippi Power. An unauthorized third party accessed limited customer account information via the company's online customer portal. The compromised data includes names, mailing addresses, phone numbers, emails, last four digits of Social Security numbers, and other basic account details. Sensitive financial information such as bank account numbers, payment card numbers, and driver’s license numbers were not accessed. The company has notified affected customers and is offering one year of free credit monitoring. The breach was detected and stopped promptly, with law enforcement engaged. Details about the intrusion timeline and attack vector have not been disclosed.
British online retailer ASOS confirmed a cyberattack involving the compromise of a third-party communication platform used to send notifications to users. Hackers sent rogue notifications to ASOS users' mobile apps, claiming full compromise of ASOS's Snowflake data platform instance and threatening data leaks. ASOS stated that basic user information such as names and contact details may have been accessed, but payment card information and passwords were not impacted. The company’s website and app operations remain unaffected. The incident was claimed by a hacking group named Xuanye Group, possibly a Chinese-speaking threat actor or a false flag. ASOS has restricted access to the compromised notification platform and is working with specialists and authorities. The exact initial access vector and details about the third-party platform remain undisclosed.
CVE-2026-105472 is a medium severity SQL injection vulnerability in the girishsaraf Online-Appointment-Booking-System affecting the book.php file's Booking Handler component. The vulnerability arises from improper handling of the Doctor/appointment argument, allowing remote attackers to execute SQL injection attacks. The product uses a rolling release strategy, so specific affected versions are not identified. The issue was reported early to the project, but no response or patch has been provided yet. Public exploit code is available, increasing the risk of exploitation.
A security flaw has been discovered in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Impacted is an unknown function of the file signup.php of the component Registration Handler. The manipulation of the argument fname results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
### Impact
`.` and `#` are not word delimiters in the tokenizer, so a flat selector such as
`.a.a.a...` reaches `splitWord()` as a single word token carrying n class or id
indexes. Three passes scanned those index arrays linearly for every index,
making the parse O(n^2) in the number of indexes rather than in input length:
`uniqs()`, the `indices.forEach` loop, and the Sass-interpolation filter.
Parsing a 400 KB flat selector took ~34 s on a modern laptop, fully occupying a
single thread. A benign selector of identical byte size parses in tens of
milliseconds, so the cost is driven by the index count, not the input size.
The nesting depth of such a selector is 0, so the `maxNestingDepth` guard added
in 7.1.3 offers no protection.
Reachability is deployment dependent. Only consumers that parse untrusted,
attacker-supplied selectors synchronously in a request path are exposed, for
example CSS sanitizers, CSS-in-JS services and online playgrounds. Ordinary
build-time use on trusted sources is not affected.
### Patches
Fixed in 7.1.6. The three passes now use Set membership tests, making parsing
linear in the number of indexes. There is no behaviour change: parsing is
byte-identical on a differential corpus of 8413 selectors.
### Workarounds
Cap the size of selectors accepted from untrusted sources before parsing.
A vulnerability was identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This issue affects the function mysqli_query of the file locateus.php of the component Doctor Search Endpoint. The manipulation of the argument doctorname leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.
A vulnerability was determined in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This vulnerability affects unknown code of the file get_town.php of the component AJAX Endpoint. Executing a manipulation of the argument countryid/townid/cid/didval/cidval can lead to sql injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2026-105468 is a medium severity SQL injection vulnerability in the girishsaraf Online-Appointment-Booking-System. It affects the Login Handler component, specifically the mysqli_query function in Admin/mlogin.php. The vulnerability allows remote attackers to manipulate the uname/pass arguments to perform SQL injection. The product uses a rolling release model, so specific affected versions are not available. The issue was reported early but the project has not responded or issued a fix yet. Exploit code has been publicly disclosed.
CVE-2026-105387 is a medium severity SQL injection vulnerability in the girishsaraf Online-Appointment-Booking-System. It affects the Patient Login Handler component, specifically the mysqli_query function in cover.php, allowing remote attackers to manipulate the uname/psw parameters to execute SQL injection. The vulnerability is publicly known and exploit code has been released. The product uses rolling releases, so exact affected and fixed versions are not available. The vendor has not yet responded or provided a fix.
CVE-2026-105254 is a medium severity SQL injection vulnerability in itsourcecode Online Admission System version 1.0. The flaw exists in an unknown function within the /admin/schoolyear.php file, where manipulation of the 'sy' argument can lead to SQL injection. The vulnerability can be exploited remotely without user interaction. Public exploit code is available, but no official patch or remediation guidance has been provided.
A vulnerability was determined in itsourcecode Online Admission System Project 1.0. This issue affects some unknown processing of the file /admin/login1.php. This manipulation of the argument User causes sql injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.
A vulnerability was determined in SourceCodester Online Reviewer Management System 1.0. The affected element is an unknown function of the file /reviewer_0/admins/assessments/Subject/btn_functions.php?action=course. Executing a manipulation of the argument Subject can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
A vulnerability was found in SourceCodester Online Reviewer Management System 1.0. Impacted is an unknown function of the file /reviewer_0/admins/assessments/Subject/btn_functions.php?action=update. Performing a manipulation of the argument Subject results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used.
A vulnerability has been found in itsourcecode Online Admission System 1.0. Affected is an unknown function of the file /admin/key.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVE-2026-105186 is a medium severity SQL injection vulnerability in itsourcecode Online Admission System version 1.0. The flaw exists in the /new.php file where manipulation of the schedid argument can lead to SQL injection. The vulnerability can be exploited remotely without user interaction. An exploit has been published but there are no known reports of active exploitation in the wild. No patch or remediation information is currently available.
A vulnerability was detected in itsourcecode Online Admission System 1.0. This affects an unknown function of the file /admin/examinee.php. Performing a manipulation of the argument ID results in sql injection. The attack can be initiated remotely. The exploit is now public and may be used.