Bottom Line Up Front
Saudi Arabia: Aramco evacuates its Dhahran headquarters. Six people with knowledge of the matter told Reuters that Aramco has told staff to leave the building and work remotely. It would be the company’s first such evacuation since the Iran war began. The Saudi-led coalition says it shot down more drones over Riyadh and Madinah today. [6][7]
GWB road rage killing: charge reduced, bail set. Retired NYPD detective Victor Romero was arraigned on first-degree manslaughter, not murder, and is held on $1 million bail. Police found him the next morning at his private security job, and court papers say he works as a driver. [1][2]
Midtown: possible hate-crime syringe attack. A 26-year-old Jewish man felt a needle-like jab in his back after being followed near Fifth Ave. and W. 47th St. at Wednesday evening rush hour. No arrest yet. [3][4]
Paris Saturday: route approved, Yellow Vest route banned. Police approved a Bastille-to-Nation march but will ban the Yellow Vests’ Bastille-to-Opéra route. Lyon has banned all protests Saturday. [8][9]
PHP2Shell: Attackers are mass-scanning for two critical PHP flaws that allow remote takeover of web servers. CISA says patch now. [10][11]
Threats to Executives & Public Figures
GWB road rage killing (follow-up): Prosecutors reduced the top charge to first-degree manslaughter. Romero did not enter a plea, and his case goes to a grand jury Oct. 26. Prosecutors say video shows him tailgating aggressively before pulling alongside Koran Irvine’s car and firing. Police found him the next morning at his private security job for a Manhattan hedge fund, with the same car parked outside. Two handguns were recovered at his Haverstraw home and a third was on him when he was arrested. Irvine’s family called the reduced charge a “miscarriage of justice.” Reported by CBS New York. [1] The criminal complaint says the car was a black Range Rover registered to a company he works for as a driver, and that he surrendered a loaded revolver he “always carries.” Reported by ABC News. [2]
Analyst note: An armed driver on a principal’s detail was charged in a fatal road rage shooting during his own commute. Temperament and judgment under provocation matter as much as a license or a background check.
Action: Review your de-escalation policy for drivers, both on duty and off. Make it clear that breaking contact is always the right call in a road confrontation.
Midtown Manhattan syringe attack (new): Police say a woman followed the 26-year-old from near 580 Fifth Ave. in the Diamond District to near W. 47th St. at about 18:00 Wednesday. He then felt a needle-like prick in his lower back. He was taken to Bellevue with injuries that are not life-threatening. It is not yet known whether the syringe contained anything. The suspect is described as a white woman in her 40s who spoke Russian. The NYPD Hate Crimes Task Force is investigating with help from Manhattan Shomrim. Tips go to 1-800-577-TIPS. Reported by ABC7 New York and NBC New York. [3][4]
Action: For principals who work in or visit the Diamond District, remind staff that someone following them on foot is a reason to get inside a staffed lobby or a vehicle.
53 St subway platform killing (arrest): A 17-year-old surrendered at Midtown North around noon and was arrested at 12:25. He is charged with murder and weapons possession in the death of Darrel Rodriguez, 26, of the Bronx. The NYPD counts 7 transit murders this year through Oct. 18, compared with 4 at this point last year. Reported by Gothamist. [5]
Middle East Travel Risk
Saudi Arabia (follow-up): It is not clear why Aramco ordered the evacuation, and the company did not immediately comment. Saudi Arabia’s main stock index fell 2.5%, and Brent crude reached $112.55 a barrel, its highest since May. A Houthi spokesperson claimed attacks on Aramco facilities in Yanbu and on the defense ministry in Riyadh. Saudi authorities have not confirmed those attacks. Reported by Reuters. [6] The coalition says it shot down five drones over the Riyadh and Madinah regions today, and four more over the Eastern Province earlier in the day. By AFP’s tally, attacks on Saudi airports have killed 22 people this month. Reported by Arab News. [7]
Action: For principals still in the Eastern Province, keep them away from Aramco and other energy sites, and have a ground route out ready in case flights are disrupted again.
Civil Unrest in Business Hubs
Paris, Saturday Oct. 24 (follow-up): The police prefecture approved the CGT union’s march from Bastille to Nation via place Félix Éboué, leaving at 14:00 Paris time (08:00 ET). The Yellow Vests’ Bastille-to-Opéra route will be banned by order, but they plan to gather at Bastille from 12:00 (06:00 ET). A court suspended the ban on Thursday’s Interfac student march. The Rhône prefecture has banned all protests in Lyon on Saturday. Reported by Le Parisien. [8]
Paris security posture: Police deployment will be 20% larger than last week. It includes GIGN, BRI and RAID tactical units, Sentinelle soldiers, helicopters, armored vehicles and water cannon. The prefect has urged shops along the route to hire private security and check their alarms and CCTV. Bastille, Reuilly-Diderot, Faidherbe and Nation Metro stations are likely to close. Reported by France 3 Paris Île-de-France. [9]
Action: Keep principals out of the Bastille–Nation corridor in the 11th and 12th arrondissements from late morning on Saturday. Plan movements around the likely Metro closures.
Cyber & Doxxing Risk to Principals
PHP2Shell (new): CISA has urged everyone to patch two critical PHP flaws right away (CVE-2026-109618 and CVE-2026-109619). They allow unauthenticated remote code execution on any PHP install serving web requests. The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Systems on PHP 8.1 or older should be taken offline until they are upgraded. [10] Amazon says the flaws are now “broadly exploited in the wild.” watchTowr says the exploit code circulating so far mostly fails to take over servers. Censys counted about 1.57 million unpatched internet-facing hosts on Oct. 21. Reported by SecurityWeek. [11]
Action: Ask the web host or IT provider for your principal’s family office, foundation or personal website to confirm that PHP has been patched.
ConnectWise (update): As of its 13:00 UTC (09:00 ET) update, ConnectWise said the phased restoration of Cloud Backup continues and its guidance has not changed: keep the affected connections disabled and review Microsoft 365 tenants. Separately, it restored its Axcient Legacy (Backup for Files) portal after remediation for two critical PHP flaws. The next update is due by 21:00 ET tonight. [12]
Severe Weather
Josephine: The National Hurricane Center issued its last advisory at 17:00 ET. Josephine is now post-tropical, about 235 miles east-southeast of Nantucket, with 65 mph winds, moving away from the U.S. Coastal flooding is expected to continue in the Mid-Atlantic through the week, along with rip currents. [13]
Vance (Eastern Pacific): As of 17:00 ET, Vance had 65 mph winds about 490 miles south-southwest of Acapulco. It is forecast to become a hurricane tonight and possibly a major hurricane by the weekend. Swells will reach the Mexican coast this weekend. No watches are in effect. [14]
Coming Up
Tonight: President Trump is scheduled to speak at about 19:00 ET (18:00 CT) at a rally at Sioux Gateway Airport, Iowa. He rallies in Fort Myers, Fla., on Friday. [15]
Sat. Oct. 24: Paris marches, with Yellow Vests at Bastille from 12:00 Paris time and the CGT march leaving at 14:00. [8]
Mon. Oct. 26: The grand jury takes up the GWB case. [1]
Sources
CBS New York, Oct. 22 — https://www.cbsnews.com/newyork/news/suspect-in-deadly-george-washington-bridge-shooting-appears-in-court/
ABC News, Oct. 22 — https://abcnews.com/US/retired-nyc-police-detective-pleads-guilty-manslaughter-charge/story?id=137476876
ABC7 New York, Oct. 22 — https://abc7ny.com/post/suspected-needle-attack-jewish-man-investigated-possible-hate-crime/19969010/
NBC New York, Oct. 22 — https://www.nbcnewyork.com/manhattan/syringe-attack-midtown-fifth-avenue/6562095/
Gothamist, Oct. 22 — https://gothamist.com/news/nypd-arrests-17-year-old-in-fatal-midtown-subway-platform-shooting
Reuters (via Investing.com), Oct. 22 — https://www.investing.com/news/commodities-news/saudi-aramco-tells-staff-to-evacuate-dhahran-as-clashes-with-yemens-houthis-continue-4965766
Arab News, Oct. 22 — https://www.arabnews.com/saudi-arabia/houthis-target-civilians-as-dammam-airport-and-energy-infrastructure-attacked-3007712
Le Parisien, Oct. 22 — https://www.leparisien.fr/paris-75/manifestation-du-24-octobre-la-prefecture-autorise-un-parcours-entre-bastille-et-nation-celui-des-gilets-jaunes-interdit-22-10-2026-5N35TQB2M5GZHCJLNUD2EHXFSY.php
France 3 Paris Île-de-France, Oct. 22 — https://france3-regions.franceinfo.fr/paris-ile-de-france/paris/manifestation-du-24-octobre-a-paris-parcours-protection-des-commercants-securite-ce-que-l-on-sait-pour-la-journee-de-samedi-3437625.html
CISA, Oct. 21 — https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching
SecurityWeek, Oct. 22 — https://www.securityweek.com/php2shell-exploitation-started-days-before-patches/
ConnectWise Trust Center advisories (updated Oct. 22, 13:00 UTC) — https://www.connectwise.com/company/trust/advisories
National Hurricane Center, Post-Tropical Cyclone Josephine Advisory 5, Oct. 22 — https://www.nhc.noaa.gov/text/MIATCPAT5.shtml
National Hurricane Center, Tropical Storm Vance Advisory 6, Oct. 22 — https://www.nhc.noaa.gov/text/MIATCPEP2.shtml
KCCI, Oct. 22 — https://www.kcci.com/article/trump-in-iowa-thursday-oct-22-sioux-city-airport-gop-rally/74217314
Breaking alerts post first on X @EPDailyBrief, with more on Instagram and Threads @executiveprotectiondaily.
Need a custom security brief for an event or trip? Request one here.
Open-source reporting only; verify before acting.