well from my own comments ( which were shot down by one poster!) but also from other, more informed industry sources, which seem to validate my assertions, it seems exceptionally unlikely that the issue can have been completely fixed by now. There may be a patch but it will probably have its own vulnerabilities. For the next few weeks I’d go through Amex travel or NatWest Black travel agencies or even BA holidays if I could “need” a hotel for my trip. I wouldn’t be putting a credit card through ba.com right now until they ask for the card number in an iframe.