Real booking details make a better payment scam

You're listening to It's probably nothing for 28 October.

Real booking details are giving fraudulent payment requests their credibility. ABC reports Australian holiday-park operators are warning guests about scams following an incident involving RMS Cloud's booking platform.

RMS says it's investigating WhatsApp, SMS and email messages that reference genuine bookings and ask for payment details. A Victorian park manager told ABC the names and dates of stay were correct.

RMS says no payment-card information has been exposed from RMS. That's a narrow reassurance: the right name and dates can supply the credibility while the message asks for the card. The intrusion route, initial-access date and number of people affected remain unresolved.

On PHP, CISA added both PHP2Shell vulnerabilities to its known-exploited catalogue on 26 October. Covered US federal agencies must carry out forensic triage and remediate by 29 October.

That's a meaningful escalation from the previously reported attack attempts, not evidence of widespread successful compromise. Patching and investigating are now explicitly separate jobs.

PHP still puts all installations serving web requests in the at-risk population. The highest demonstrated risk is in mod_php, where exploitation can happen before application code runs. PHP has released fixes, and says configuration mitigations aren't a complete solution.

There's also a namespace boundary problem in consul-k8s when system ACL management is enabled. HashiCorp says an attacker who can create a ServiceAccount and obtain its token in another namespace, and reach the Consul API, may authenticate as a Consul component and obtain its associated privileges.

The failure is insufficient namespace restrictions in component binding rules: an awkward boundary failure for shared clusters. Deployments with system ACL management disabled aren't vulnerable. HashiCorp has released fixes.

Finally, TRM Labs attributes approximately 1.07 billion US dollars in crypto receipts to 34 physical casinos in Sihanoukville between 1 January and 7 September 2026.

More pointedly, it reports approximately 322 million US dollars received after the relevant sanctions designation dates by entities it attributes to Xihu, Huan Hai and a casino associated with Jin Bei Group.

These are TRM's attributions, not independently verified totals or proof that every receipt was criminal. TRM also cautions that wallet rotation may make declining attributed inflows overstate the actual reduction in activity. Losing sight of the money isn't the same as stopping it.

That's it for this edition. Until next time.

Don't forget, all our threat intelligence comes from Mallory dot A I and open sources. If you want intelligence your team can act on, reach out for a chat.