# Real booking details make a better payment scam > Plus PHP2Shell’s KEV escalation, a Consul namespace bypass and casino crypto flows. - Series: It's Probably Nothing - Publisher: Sierra Echo Charlie - Edition date (Pacific/Auckland): 2026-10-28 - Edition number: 15 - Status: Published edition - Language: en-NZ - [Canonical web edition](https://ipn.nz/editions/2026-10-28) - [Download PDF](https://ipn.nz/pdf/IPN-2026-10-28.pdf) - [MP3 audio](https://ipn.nz/audio/IPN-2026-10-28.mp3) (2:51, 2738511 bytes) - [Standalone transcript](https://ipn.nz/transcripts/2026-10-28.md) ## Opening The uncomfortable bit of the holiday-park story is how little a convincing payment scam needs: the right name, the right dates and a plausible request. ## 1. Genuine bookings, fraudulent payment requests ABC reports Australian holiday-park operators are warning guests about payment scams following an incident involving RMS Cloud’s booking platform. RMS says it’s investigating WhatsApp, SMS and email messages that reference genuine booking information and request payment details. A Victorian park manager told ABC the names and dates of stay were correct. RMS says no payment-card information has been exposed from RMS. That’s a narrow reassurance: booking details can supply the credibility while the message asks for the card. The intrusion route, initial-access date and affected population remain unresolved. ### Sources - [Major holiday park operators warn guests about fraudulent emails, messages seeking credit card details]() — reporting/context ## 2. PHP2Shell moves from patching to forensic triage CISA has added both PHP2Shell vulnerabilities, [CVE-2026-109618]() and [CVE-2026-109619](), to its known-exploited catalogue, dated 26 October. Covered US federal agencies must carry out forensic triage and remediate by 29 October. That’s a meaningful escalation from the previously reported attack attempts, not evidence of widespread successful compromise. Patching and investigating are now explicitly separate jobs. PHP still puts all installations serving web requests in the at-risk population, with the highest demonstrated risk in mod\_php, where exploitation can precede application code. The fixes remain PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP says configuration mitigations aren’t a complete solution. ### Sources - [CISA Catalog of Known Exploited Vulnerabilities]() — primary source - [Critical Vulnerabilities in PHP Require Immediate Patching]() — primary source - [PHP: News Archive – 2026]() — primary source - [Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities]() — primary source - [PHP Releases Emergency PHP2Shell RCE Fixes as Attack Attempts Prompt Website Shutdowns]() — reporting/context ## 3. Consul component privileges from the wrong namespace If you run consul-k8s with global.acls.manageSystemACLs=true, [CVE-2026-110720]() is worth checking. HashiCorp says an attacker who can create a ServiceAccount and obtain its token in another namespace, and reach the Consul API, may authenticate as a Consul component and obtain its associated privileges. The failure is insufficient namespace restrictions in component binding rules: an awkward boundary failure for shared clusters. Deployments with system ACL management disabled aren’t vulnerable. HashiCorp supplies fixes in consul-k8s 1.8.18 and 2.1.0. ### Sources - [HCSEC-2026-50 – Consul-k8s vulnerable to a cross-namespace authorization bypass in component ACL binding rules]() — primary source ## 4. Sanctions haven’t stopped the casino crypto flows TRM Labs attributes approximately US$1.07 billion in crypto receipts to 34 physical Sihanoukville casinos between 1 January and 7 September 2026. More pointedly, it reports approximately US$322 million received after the relevant designation dates by entities it attributes to Xihu, Huan Hai and a Jin Bei Group-associated casino. These are TRM’s attributions, not independently verified totals or proof that every receipt was criminal. TRM also cautions that wallet rotation may make declining attributed inflows overstate the actual reduction in activity. Losing sight of the money isn’t the same as stopping it. ### Sources - [Crypto Continues to Flow Through Sihanoukville Casinos Despite Cambodia's Crackdown]() — primary source - [Sihanoukville Casinos Receive $1.07 Billion in Crypto Despite Sanctions and Crackdowns]() — reporting/context ## Audio transcript Narrated using an AI voice. You're listening to It's probably nothing for 28 October. Real booking details are giving fraudulent payment requests their credibility. ABC reports Australian holiday-park operators are warning guests about scams following an incident involving RMS Cloud's booking platform. RMS says it's investigating WhatsApp, SMS and email messages that reference genuine bookings and ask for payment details. A Victorian park manager told ABC the names and dates of stay were correct. RMS says no payment-card information has been exposed from RMS. That's a narrow reassurance: the right name and dates can supply the credibility while the message asks for the card. The intrusion route, initial-access date and number of people affected remain unresolved. On PHP, CISA added both PHP2Shell vulnerabilities to its known-exploited catalogue on 26 October. Covered US federal agencies must carry out forensic triage and remediate by 29 October. That's a meaningful escalation from the previously reported attack attempts, not evidence of widespread successful compromise. Patching and investigating are now explicitly separate jobs. PHP still puts all installations serving web requests in the at-risk population. The highest demonstrated risk is in mod\_php, where exploitation can happen before application code runs. PHP has released fixes, and says configuration mitigations aren't a complete solution. There's also a namespace boundary problem in consul-k8s when system ACL management is enabled. HashiCorp says an attacker who can create a ServiceAccount and obtain its token in another namespace, and reach the Consul API, may authenticate as a Consul component and obtain its associated privileges. The failure is insufficient namespace restrictions in component binding rules: an awkward boundary failure for shared clusters. Deployments with system ACL management disabled aren't vulnerable. HashiCorp has released fixes. Finally, TRM Labs attributes approximately 1.07 billion US dollars in crypto receipts to 34 physical casinos in Sihanoukville between 1 January and 7 September 2026. More pointedly, it reports approximately 322 million US dollars received after the relevant sanctions designation dates by entities it attributes to Xihu, Huan Hai and a casino associated with Jin Bei Group. These are TRM's attributions, not independently verified totals or proof that every receipt was criminal. TRM also cautions that wallet rotation may make declining attributed inflows overstate the actual reduction in activity. Losing sight of the money isn't the same as stopping it. That's it for this edition. Until next time. Don't forget, all our threat intelligence comes from Mallory dot A I and open sources. If you want intelligence your team can act on, reach out for a chat. ## Publisher Researched by our AI agents using [Mallory](https://mallory.ai) and original sources. Reviewed and published by [Sierra Echo Charlie](https://sierraechocharlie.com). Want intelligence your team can act on? [Reach out for a chat.](mailto:letsgo@sierraechocharlie.com)