Bottom Line Up Front
Riyadh’s King Khalid airport is operating under tight restrictions, and many airlines are still cancelling flights. The National reports it reopened Sunday. Saudi notices require prior permission for every flight, and the U.S. Mission’s latest alert still lists the airport as suspended. [8][9][10][11]
Guam avoided a direct hit from Super Typhoon Champi, which passed just south of the island early Sunday. The governor has declared COR 4, and the typhoon warnings are cancelled. Hurricane Trudy (105 mph) is bringing heavy rain and strong winds to Mexico’s west-central coast and is forecast to weaken rapidly tonight. [25][26][27]
Powder-letter investigation: The FBI says the letters share a North Texas mail-processing center and a “Thinking of You” postmark. At least nine California members of Congress, including Sen. Alex Padilla, were targeted. [1][2]
DC today: U.S. Capitol Police are running a training exercise on Capitol grounds with emergency vehicles, low-flying helicopters and simulated gunfire. [7]
For solo operators: Near the Capitol today, don’t treat emergency vehicles, low helicopters or simulated gunfire as a live incident, but confirm before you react. [7] Don’t send anyone to Riyadh’s airport until the airline confirms the flight. [8][11] Mexico’s Pacific coast from Punta San Telmo to San Blas, including the Puerto Vallarta area, remains under hurricane or tropical storm warnings today. [25] For corporate security teams: Briefing items for leadership: (1) keep mailroom screening in place, since officials warned that some letters may still reach their destinations, [1] (2) plan any Riyadh travel for FII10 (Oct. 26–29) around restricted airport operations, [8][34] (3) ask IT or your managed service provider whether ConnectWise Cloud Backup or Cloud Management apps have access to your Microsoft 365 tenant. [18]
Threats to Executives & Public Figures
Suspicious mailings (U.S.), update: At least nine California members of Congress received suspicious white-powder letters, including Sen. Alex Padilla and Reps. Gil Cisneros, Jimmy Panetta, Kevin Kiley, Zoe Lofgren, Ami Bera and Mark DeSaulnier. A Kiley staffer opened one and put it straight into a quarantine enclosure. The Roseville Fire Hazmat Task Force responded, and no injuries were reported. Preliminary tests indicate the substance is not hazardous. The FBI said Saturday it is still working to identify those responsible. Reported by the Los Angeles Times. [1]
According to the FBI, the recovered letters share common traits: processing through a North Texas mail facility and a “Thinking of You” postmark. U.S. Capitol Police told congressional offices, especially district offices, to stay alert. Illinois Reps. Mike Quigley, Brad Schneider, Robin Kelly and Jan Schakowsky reported envelopes; Quigley said his contained threatening language aimed at Democrats. Reported by ABC7 Chicago. [2] Rep. Seth Moulton’s Salem, Mass., office reported a letter with the same return address as the others; staff didn’t open it, and later testing found no substances of concern. Reported by CBS Boston. [3]
Analyst note: Several offices caught letters from their outside markings and never opened them. [2][3] Make sure everyone who handles mail for your principal knows the markers.
Florida: Luke Schlauder of Boca Raton is being held without bond, accused of leaving voicemails threatening to slit state Rep. Peggy Gossett-Seidman’s throat if her office sent him more mail. Police say he admitted leaving the messages because he was tired of her office’s mailers. His next court date is Nov. 14. Reported by WPBF. [4]
Analyst note: Routine constituent mail set off this threat. Watch for hostility toward a principal’s outreach mailings as well as their public statements.
West Bank: On Saturday in Taybeh, Israeli settlers attacked European diplomats, a visiting French mayor and the archbishop of Cambrai. Three people were injured and the window of a Belgian mission armored car was smashed. Israeli Foreign Minister Gideon Sa’ar condemned the attack, said police had opened an investigation, and said diplomats who travel without military coordination risk attacks. On Friday, a Washington Post photographer was severely injured in a separate settler attack. Reported by The Guardian. [5]
NYC (Midtown subway homicide), update: As of late Saturday, no arrest had been announced in the fatal shooting on the northbound E platform at 7 Av–53 St. Police say the shooting was not random. The suspect was last seen heading north on 7th Avenue in a red tracksuit, black vest and black face mask, carrying a backpack. Tips: 1-800-577-TIPS. Reported by ABC7 New York. [6]
Travel Advisories & Hotspots
Saudi Arabia: King Khalid International Airport in Riyadh reopened Sunday after closing because of Houthi attacks, but many airlines have not resumed flights. Reported by The National. [8] New Saudi aviation notices issued Saturday require prior permission for every flight into or out of Riyadh and bar the airport from use as a diversion alternate. Shortly after the closure notice expired Saturday night, Saudi Civil Defense issued an early warning alert in Riyadh. Reported by Contrail. [9] As of 14:00 local time, the RUH Watch flight board listed 193 of Sunday’s 265 Riyadh arrivals as cancelled. [10]
The U.S. Mission’s latest alert (Oct. 17) still says Riyadh operations are suspended and that Jeddah and Dammam are open with delays. U.S. government staff need Chief of Mission approval to use any Saudi airport. The alert lists rail and bus alternatives, notes that airports in Bahrain, Jordan, Oman, Qatar and the UAE remain open, and repeats the Interior Ministry’s warning that filming or sharing interceptions or impact sites carries legal liability. [11]
Civil Unrest in Business Hubs
Tirana, Albania (day 5): On Saturday, protesters threw stones, petrol bombs and fireworks at police near the prime minister’s office. Police used tear gas, water cannons, baton charges and, for the first time, rubber bullets, which national police chief Skender Hita said were used “in a limited manner.” Police report 167 arrests and 132 injured officers over five days, and seven officers have been suspended pending excessive-force investigations. Local media also reported burning barricades in Durrës. Reported by Al Jazeera (AFP/AP) and Euronews. [12][13]
Guadalajara, Mexico (today): The U.S. Mission warns of a “Mega March for Water” starting at 11 a.m. from Parque Rojo (Parque Revolución) to the Government Palace downtown. Expect a heavy police presence and traffic disruption along Avenida Juárez and across the city. [14]
Serbia: Student-led walks to Belgrade are under way. The first group left Zaječar on Friday and is due in the capital for the Oct. 22 Slavija Square rally (see Week Ahead). [15][16]
Aviation & Transport
Saudi routes: Reported by The National. [8]
Etihad (Abu Dhabi–Riyadh) and flydubai (Riyadh, Dammam, Abha) have cancelled flights until Oct. 19.
Oman Air has suspended Riyadh flights until Oct. 22.
Air France has suspended Riyadh flights through Oct. 24. Air India, Air India Express and IndiGo have suspended multiple Saudi cities through Oct. 24.
KLM has cancelled Riyadh and Dammam flights through Oct. 31.
Lufthansa has suspended Riyadh until Nov. 18 and Dammam through Nov. 30.
Qatar Airways and Air Arabia have announced no resumption date.
Delta has pushed its Atlanta–Riyadh launch, originally set for Oct. 23, to March 2027.
U.S.: As of 11:06 UTC (7:06 a.m. ET), the FAA listed no ground stops or delay programs at U.S. airports. [17]
Cyber & Doxxing Risk to Principals
ConnectWise Cloud Backup (Microsoft 365): ConnectWise has shut off customer access to the service after attackers abused its application identities to get into Microsoft 365 tenants. Huntress counted at least 162 compromised tenants in its environment, and Microsoft calls it an active supply-chain attack. Because the attackers signed in as the backup app, multi-factor authentication didn’t stop them. Researchers say that access could let an attacker read and write mail, OneDrive and SharePoint files, and Teams chats. Huntress advises reviewing app credentials added since Oct. 13. Reported by BleepingComputer. [18]
Nikkei Inc. (update): The publisher now says about 1.83 million items of personal information leaked. About 150,000 of them include a name, email address, postal address, phone number or date of birth, and about 120,000 include an email address. No credit card data was included. [19]
Japan, other disclosures: Reported by The Japan Times (Jiji). [20]
Yamato Transport: 5.31 million records (names, addresses, phone numbers) from its deferred-payment service.
Times Car operator: about 6.6 million records affected, about 1.6 million of them with images of driver’s licenses or other ID documents.
Fancl and Attenir: about 830,000 customers.
Action: If a principal’s company, family office or household IT provider uses ConnectWise cloud tools, ask for written confirmation that the tenant checks are done. Until then, treat mailbox and file contents as potentially exposed. [18]
Severe Weather
Northeast U.S. (NWS): A Freeze Warning covers Orange and Putnam counties in New York, western Passaic County in New Jersey and northern Connecticut until 9 a.m. today. [21] NYC is sunny with a high near 58. The NWS forecast has no rain through Saturday, with a breezy stretch Tuesday night into Wednesday. [22]
Southern California: No Red Flag Warnings are in effect this morning. NWS Beach Hazards Statements cover the Ventura, Malibu, LA, Orange and San Diego county coasts from this morning through 9 a.m. PT Tuesday, with 3–6 ft surf and dangerous rip currents. [24] The Norte Fire is 570 acres and 25% contained. All evacuation orders were lifted at 6 p.m. Saturday, but Via La Mirada stays closed north of Esperanza and the burn scar is closed until further notice. [23]
Hurricane Trudy (E. Pacific, NHC): As of 0900 UTC, Trudy had 105 mph winds and was about 135 mi WSW of Manzanillo, moving NW at 10 mph. The center is expected to stay near the coast through this evening, then move south of Baja California Sur Monday and Tuesday, with rapid weakening starting tonight. A Hurricane Warning covers Manzanillo to Cabo Corrientes. Tropical Storm Warnings cover the coast south of Manzanillo to Punta San Telmo, north of Cabo Corrientes to San Blas, and the Islas Marías. NHC expects 4–8 in. of rain, locally around 12 in., in Michoacán, Colima and Jalisco, with possible life-threatening flooding and mudslides. [25]
Super Typhoon Champi (W. Pacific, NWS Guam): As of 0900 UTC, Champi had 150 mph winds and was about 200 mi west of Guam, moving west at 14 mph and away from the Marianas. No tropical cyclone watches or warnings remain in effect. [26] The eye passed about 13–15 mi from Malesso’ around 4:30 a.m. local time. The governor declared COR 4 at 6 p.m., and her initial assessment found no significant ocean inundation, collapsed buildings, impassable roads or mudslides. Guam public schools are closed Monday for damage assessments. Reported by the Pacific Daily News. [27]
Tradecraft Tip (general guidance, not tailored advice)
“Reopened” is a headline, not a plan. After a facility closes because of an attack or a storm, news reports, official notices and actual operations can disagree for a day or more. Before you move a principal, confirm with the operator itself (the airline, hotel or venue), the facility’s own channel, and the relevant embassy or local authority. Keep the fallback route booked until the first leg is actually under way.
Week Ahead (Oct. 19–25)
New York:
Paley International Council Summit, Oct. 19–21: Media and business leaders meet at the Paley Museum in Midtown. The organizers say it draws dignitaries and chief executives. [28]
Greenbuild, Oct. 20–23: The conference runs at the Javits Center, with the entrance at 445 11th Ave. at 38th St. [29]
Early voting: Starts Saturday, Oct. 24 (9 a.m.–5 p.m. in NYC) and runs through Nov. 1. Election Day is Nov. 3. [30]
Washington, DC region:
Marine Corps Marathon, Sunday, Oct. 25: The race starts at 7:20 a.m. on Route 110 in Arlington.
Road closures: Arlington closures run from about 3 a.m. to 6 p.m. Southbound Route 110 closes at 4 p.m. Saturday, Oct. 24. DC police and U.S. Park Police will also close roads in the District. [31]
Los Angeles:
Grand Ave Arts: All Access and Grand Park’s Downtown Día de los Muertos, Saturday, Oct. 24: Both run 11 a.m.–4 p.m. along Grand Ave. from Temple St. to 6th St. [33]
Presidential travel (public schedule): Each stop is a political rally. Check FAA TFR listings if your principals fly into those areas. Reported by Roll Call Factba.se. [32]
Oct. 19: Park City, Kan.
Oct. 20: Greenville, N.C.
Oct. 21: Pendleton, S.C.
Oct. 22: Sioux City, Iowa
Oct. 23: Fort Myers, Fla.
Oct. 24: Macon, Ga.
Oct. 25: Port Huron, Mich.
International:
Belgrade: A student-led rally at Slavija Square on Thursday, Oct. 22, ahead of Serbia’s Oct. 25 parliamentary election. The U.S. Embassy warns of heavy police presence and road closures, and notes that some past demonstrations have turned violent. [15][16]
Just past the window: FII10 runs Oct. 26–29 at Riyadh’s King Abdulaziz International Conference Center, with heads of state and Fortune 500 CEOs among the expected speakers. Plan arrivals around the restricted Riyadh airport operations noted above. [34][8]
Sources
Los Angeles Times, Oct. 17 — https://www.latimes.com/business/story/2026-10-17/suspicious-white-powder-letters-sent-to-california-lawmakers
ABC7 Chicago, Oct. 17 — https://abc7chicago.com/post/warning-issued-members-congress-suspicious-envelopes-including-rep-robin-kelly-more-illinois-officials/19945443/
CBS Boston, Oct. 17 — https://www.cbsnews.com/boston/news/seth-moulton-congress-suspicious-mail/
WPBF, Oct. 17 — https://www.wpbf.com/article/boca-raton-death-threats-peggy-gossett-seidman/74160022
The Guardian, Oct. 17 — https://www.theguardian.com/world/2026/oct/17/israeli-settlers-attack-european-diplomats-in-west-bank
ABC7 New York, Oct. 17 — https://abc7ny.com/post/nyc-subway-shooting-53rd-street-station-leaves-man-critically-injured/19948241/
U.S. Capitol Police (@CapitolPolice) —
The National, Oct. 18 (updated 9:20 a.m.) — https://www.thenationalnews.com/travel/2026/10/18/riyadh-airport-reopens-which-airlines-are-still-cancelling-flights-to-saudi-arabia/
Contrail, Oct. 17 (updated 5:15 p.m. ET) — https://www.thecontrail.org/riyadh-airport-reopening-flights-permission/
RUH Watch, Riyadh arrivals Oct. 18 — https://ruhwatch.com/en/arrivals/2026-10-18/
U.S. Mission to Saudi Arabia, Security Alert Oct. 17 — https://sa.usembassy.gov/security-alert-u-s-mission-to-saudi-arabia-october-17-2026/
Al Jazeera (AFP/AP), Oct. 17 — https://www.aljazeera.com/news/2026/10/17/albanian-police-fire-rubber-bullets-as-protests-against-rama-escalate
Euronews, Oct. 17 — https://www.euronews.com/2026/10/17/albanian-police-fire-rubber-bullets-and-arrest-hundreds-as-anti-government-protests-enter-
U.S. Mission to Mexico, Demonstration Alert (Guadalajara) — https://mx.usembassy.gov/demonstration-alert-mega-march-for-water-in-guadalajara-on-october-18-at-1100-a-m/
N1, Oct. 16 — https://n1info.rs/english/news/students-start-march-to-belgrade/
U.S. Embassy Belgrade, Demonstration Alert Oct. 16 — https://rs.usembassy.gov/demonstration-alert-u-s-embassy-belgrade-serbia-october-16-2026/
FAA NAS Status (11:06 UTC) — https://nasstatus.faa.gov/
BleepingComputer, Oct. 17 — https://www.bleepingcomputer.com/news/security/hackers-breach-microsoft-365-tenants-via-connectwise-supply-chain-attack/
Nikkei Inc., Oct. 16 — https://www.nikkei.co.jp/nikkeiinfo/en/news/announcements/1562.html
The Japan Times (Jiji), Oct. 17 — https://www.japantimes.co.jp/news/2026/10/17/japan/crime-legal/more-data-breaches-japan/
NWS active alerts, New York — https://api.weather.gov/alerts/active?area=NY
NWS forecast, New York City — https://forecast.weather.gov/MapClick.php?lat=40.7142&lon=-74.0059
CAL FIRE, Norte Fire — https://www.fire.ca.gov/incidents/2026/10/16/norte-fire
NWS active alerts, California — https://api.weather.gov/alerts/active?area=CA
NOAA National Hurricane Center, Trudy Advisory 20 — https://www.nhc.noaa.gov/text/refresh/MIATCPEP1+shtml/010547.shtml
NWS Guam, Super Typhoon Champi Advisory 16 — https://forecast.weather.gov/product.php?format=CI&glossary=0&issuedby=PQ2&product=TCP&site=GUM&version=1
Pacific Daily News, Oct. 18 — https://www.guampdn.com/news/6-p-m-sunday-governor-declares-cor4/article_ed581d40-913f-436b-9f1e-5d950bf75226.html
The Paley Center for Media — https://www.paleycenter.org/press-releases/pics-2026-announce
Greenbuild 2026, show information — https://informaconnect.com/greenbuild/show-information/
NYC Board of Elections — https://www.vote.nyc/election/general-election-early-voting-day-1
Arlington County, Marine Corps Marathon traffic alert, Oct. 16 — https://www.arlingtonva.us/About-Arlington/Newsroom/Articles/2026/TRAFFIC-ALERT-51st-Annual-Marine-Corps-Marathon
Roll Call Factba.se, President’s public schedule — https://rollcall.com/factbase/trump/calendar/
The Music Center, Grand Ave Arts: All Access — https://www.musiccenter.org/tickets-free-events/tmc-arts/grand-ave-arts-all-access/
FII Institute, FII10 — https://fii-institute.org/conference/fii-10th-edition/
Breaking alerts post first on X @EPDailyBrief, with more on Instagram and Threads @executiveprotectiondaily.
Open-source reporting only; verify before acting.