There was a SQL injection attack as well as the URL substitution one.