Bottom Line Up Front
Saudi Arabia: attacks continue overnight. Shortly after 04:00 Saudi time Friday (21:00 ET Thursday), the Saudi-led coalition says it intercepted a ballistic missile heading for Riyadh. Civil defence alerts sounded in Riyadh and then Najran. Reported by Arab News and Middle East Eye. [1][2] Aramco has ordered a full evacuation of its Dhahran headquarters, and its remaining essential staff are working from home. Reported by Reuters and Gulf News (AFP). [4][5]
GWB killing: Retired NYPD detective Victor Romero, 62, has been arraigned on a reduced charge of first-degree manslaughter and is held on $1 million cash bail. A grand jury takes up the case Oct. 26. [9][10][11] Outlets disagree on several details (see below).
France and Italy: Paris police have approved a Bastille-to-Nation route for Saturday at 14:00 and banned a Yellow Vest route from Bastille to Opéra. The police prefect is urging shops to hire private security. [24][25] Five hundred Folgore paratroopers are now deployed on Milan’s streets. [26][27]
Also today: Typhoon Champi has shut most of Taiwan and cancelled 977 flights. [28][30] Hurricane Vance is rapidly strengthening off Mexico. [36] A 17-year-old is held without bail in the 53rd Street subway killing. [15][16][17]
For solo operators: If your principal is in Paris Saturday, keep clear of Bastille from 12:00 and of the Bastille–Nation corridor from 14:00. Expect Bastille, Reuilly-Diderot, Faidherbe and Nation Métro stations to close. [24][25] If your principal flies to Taiwan, Okinawa or Riyadh in the next 48 hours, confirm each leg directly with the airline. [8][30]
For corporate security teams: Briefing items for leadership: (1) Aramco’s full HQ evacuation and the overnight missile aimed at Riyadh are reasons to re-check dependents, remote-work and overland exit plans for any Eastern Province or Riyadh staff, [1][4][5][6] (2) Paris and Milan retail and office sites near Saturday’s routes should review shutters, alarms and CCTV, [25][26] (3) patch PHP2Shell now. Exploitation attempts are widespread, though no confirmed successful compromise has been reported. [32][33]
Threats to Executives & Public Figures
George Washington Bridge (follow-up): Victor Romero, 62, a retired NYPD detective, was arraigned Thursday on first-degree manslaughter in the killing of Koran Irvine, 46. Police had charged him with murder at arrest, and the Manhattan DA’s office downgraded the charge. Judge Kevin McGrath set bail at $1 million cash. A grand jury hears the case Oct. 26. [9][10][11] Prosecutors say Romero “pulled to the right of” Irvine’s car on the bridge approach and fired, with the shot entering through the back passenger window. Police traced his car by its license plate and found him at work in Manhattan the next day with a revolver, which prosecutors say he carried daily. Two more handguns were recovered from his home. [11] Irvine’s family calls the reduced charge a “miscarriage of justice” and is looking into a lawsuit against Romero and the security company. [9][11]
Where outlets disagree:
Plea: ABC News reports that Romero “pleaded not guilty.” [12] CBS New York reports he did not enter a plea, and Gothamist says he “remained silent.” [9][11] In New York felony cases, a plea is normally entered only after indictment, so CBS and Gothamist are more likely correct.
Day of the shooting: ABC’s text says “Wednesday night.” CBS, NY1 and ABC’s own photo caption say Tuesday, Oct. 20. [9][10][12]
Job: The affidavit cited by ABC says Romero worked as a driver for the company that owns his Range Rover. [12] CBS says he worked private security for a Manhattan hedge fund. [9] His lawyer, quoted by Gothamist, called him a “security director.” [11]
Arrest: ABC says he surrendered at the 33rd Precinct. CBS, NY1 and Gothamist say police found him at work. [9][10][11][12]
Analyst note: The accused is a retired detective with a carry license who was working in executive security when he was arrested. Expect firms to face questions about vetting and use-of-force policy for armed drivers and security staff.
Midtown syringe attack (follow-up): As of Thursday evening, no one had been arrested. A woman in her 40s stabbed a 26-year-old man in Hasidic dress just before 18:00 on W. 47th St. in the Diamond District. Investigators believe the weapon was a syringe. The victim is stable at Bellevue. The NYPD Hate Crimes Task Force is investigating. [13][14]
Action: For visibly Jewish principals in Midtown, brief the suspect description (woman in her 40s) and keep close cover on approach, especially around 47th St.
53rd Street subway killing (follow-up): Xavian Collins, 17, surrendered with his attorney at Midtown North Thursday. He is charged as an adult with murder and two weapons counts in the Oct. 17 shooting of Darrel Rodriguez, 26. Judge Rachel Pauley ordered him held without bail. [15][16][17] Investigators say the dispute began when Rodriguez confronted him for smoking marijuana on the train. The NYPD counts seven subway murders this year, compared with four at this point in 2025. [15][16]
Texas: teen accused of plotting to kill Rep. Keith Self. A 17-year-old from McKinney was arrested Oct. 5 and federally charged with planning to shoot Rep. Self at an Oct. 17 veterans chili cook-off fundraiser. He is also accused of planning a separate ISIS-inspired attack. Self told NBC 5 he attended the event as planned and “nothing, of course, happened.” Capitol Police told the campaign about the arrest on Oct. 6. The teen is in federal custody and has not been named. The arrest was confirmed by federal sources and Self’s campaign. The FBI had not commented publicly. Reported by WFAA and NBC DFW. [18][19]
Analyst note: The plot targeted a small, local fundraiser, the kind of event that gets the least protection. Advance teams should treat publicly advertised local events as higher-risk venues.
Suspicious letters to Congress (follow-up): Illinois Reps. Jan Schakowsky, Mike Quigley and Brad Schneider each said Wednesday they had received a second suspicious mailing within a week. FBI and hazmat teams responded at Schakowsky’s Skokie office, and authorities gave the all-clear. [20][21] Dozens of offices from both parties have now been targeted since Oct. 13, and no arrests have been announced. Reported by UPI. [20]
Action: For any principal who has received a suspicious letter, expect more. Keep mail screening off-site or isolated until arrests are made.
Australia (Haines case, follow-up): Helen Haines, 65, remains in critical but stable condition at The Alfred hospital, and both of her legs have been amputated. Her staff hope to reopen her Wangaratta office next Thursday. [22][23] Police are still investigating the motive. Reported by 7NEWS. [23]
Travel Advisories & Hotspots
Saudi Arabia:
Overnight: The coalition says it intercepted a ballistic missile toward Riyadh shortly after 04:00 Friday and two drones at about 01:00 (Saudi time). [1][2]
Casualties: Coalition and Saudi Press Agency figures compiled by Arab News put October’s toll at 24 dead and at least 374 injured. That includes 18 killed at Riyadh’s King Khalid airport between Oct. 7 and 11. Dammam’s toll stands at two dead (a Saudi and an Indian national) and eight wounded. [1][3][4]
Houthi claims: Houthi military spokesman Yahya Saree claimed attacks on the Saudi defense ministry in Riyadh and Aramco facilities in Yanbu. Treat these as Houthi claims only. Reported by Dawn. [3]
Advisory level: The U.S. Embassy has issued no new security alert since Oct. 21. That alert warned the hostilities “have the potential to escalate rapidly” and requires U.S. government staff to get Chief of Mission approval before using any Saudi airport. [6] The State Department Travel Advisory remains Level 3 (Reconsider Travel), last issued Oct. 12. It warns that people have been detained for photographing interceptions or impact sites. [7]
Action: Use the land routes the embassy lists, including SAR rail, SAPTCO and the King Fahd Causeway to Bahrain, as your fallback to air travel. [6]
Aramco, Dhahran (follow-up): Aramco has ordered a full evacuation of its Dhahran headquarters. All remaining essential staff will work from home until further notice. Reported by Gulf News (citing AFP) and Reuters (six sources). [4][5] The reason for the evacuation is unclear, and Aramco had not commented. [4]
Regional spillover: Iran’s Revolutionary Guards (IRGC) have warned the U.S. against escorting ships through the Strait of Hormuz. Egypt’s parliament postponed until Oct. 26 a vote on authorizing military support for the Saudi campaign. Brent crude rose $3.51 to $112.33. Reported by Dawn (agencies). [3]
Civil Unrest in Business Hubs
Paris, Saturday Oct. 24 (follow-up): The police prefecture has approved a CGT-proposed route from Bastille to Nation, departing at 14:00. The route runs via rue de Lyon, av. Daumesnil, bd de Reuilly, bd de Picpus and av. du Trône. [24][25] The prefecture says the Yellow Vest/Interfac route from Bastille to Opéra “will be the subject of a ban order.” The Yellow Vests say they will be at Bastille from 12:00 anyway. [24][25] Prefect Patrice Faure cited violence after recent marches, especially Oct. 13. He urged shopkeepers to hire “private security agents” and to check their alarms and CCTV. [25] City Hall will open a crisis cell at 12:00 Saturday and has cancelled some public events. Bastille, Reuilly-Diderot, Faidherbe and Nation stations are expected to close. [25]
Action: Plan routes that avoid Bastille, Nation and Opéra from late morning. Expect breakaway groups toward Opéra despite the ban.
Milan: As of Friday, 500 Folgore paratroopers are patrolling stations, squares and the city center with police under Operation Strade Sicure, ahead of a demonstration called in Piazza del Duomo. They have no judicial police powers and may not carry Tasers or pepper spray, limits Defense Minister Guido Crosetto has criticized. [26][27] The deployment runs to the end of the year. [27]
Aviation & Transport
Taiwan (Typhoon Champi): Taiwan’s Civil Aviation Administration says 977 flights were cancelled as of 10:00 Friday: 262 domestic and 715 international and cross-strait. Ninety-six ferry sailings were also suspended. EVA Air cancelled all of Friday’s long-haul flights to Europe and the U.S. Starlux is flying only long-haul routes. [30] The Taiwan Stock Exchange is closed. [28]
Riyadh (RUH): Restrictions remain at King Khalid International. Saudia and Riyadh Air are flying some Riyadh passengers into Al Qassim (Buraydah), 375 km away, and then busing them to the capital. Reported by Aerospace Global News. [8] The U.S. Embassy’s Oct. 21 alert described RUH operations as “suspended” and said Jeddah and Dammam were operating with some delays. [6] Sources describe RUH differently, so confirm each flight directly with the airline.
Dammam (DMM): Saudi aviation authority GACA says King Fahd International has resumed normal operations after Wednesday’s attack. [4]
Cyber & Doxxing Risk to Principals
PHP2Shell (follow-up): Attackers are attempting to exploit PHP flaws CVE-2026-109618 and -109619 at large scale, trying to install a Mirai-variant botnet called “Potassium.” Sophos says it has seen no successful remote code execution in the wild yet. Reported by The Hacker News. [33] CISA calls the flaws critical and urges immediate patching to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. [32][33]
ConnectWise Cloud Backup (formerly SkyKick), follow-up: As of the 01:00 UTC update Oct. 23 (21:00 ET Thursday), ConnectWise expects to finish testing the restored environment “by the end of this weekend.” It plans to restore access to backups early next week, followed by phased re-enrollment. Partners should keep affected connections disabled, and Microsoft 365 tenant reviews are still required. Updates move to once daily starting today. [31]
Plex2Shell (follow-up): CISA’s deadline for federal agencies to fix two of the four actively exploited Plex Media Server flaws (CVE-2026-96654 and -96656) is today, Oct. 23. [34] Update Plex Media Server to the latest release.
Action: Check principals’ home media servers and family NAS devices. These are common entry points to home networks.
Severe Weather
Post-Tropical Cyclone Josephine (NHC final advisory, 17:00 ET Thursday): Josephine is now a powerful extratropical low about 235 miles east-southeast of Nantucket, with 65 mph winds, moving northeast at 17 mph away from the U.S. It is expected to bring hurricane-force winds over open water tonight or early Friday. Minor to locally moderate coastal flooding continues along the Mid-Atlantic at high tide, with dangerous surf and rip currents along the East Coast. [35]
New York and New Jersey (NWS): NYC will be sunny today with a high near 60 and northeast winds of 8–14 mph. Tonight will be mostly clear with a low around 46. [38] A Frost Advisory covers Southern Westchester and southern Connecticut until 09:00 Saturday. A Freeze Watch covers Morris, Hunterdon and Somerset counties, N.J., until 09:00 Saturday. A Coastal Flood Advisory remains for Ocean County, N.J., and the Delaware beaches until midnight. [37]
North Carolina and Florida (NWS): A Coastal Flood Advisory and Beach Hazards Statement cover Hatteras Island until 20:00. Coastal Flood Advisories run along most of Florida’s Atlantic coast into Saturday or Sunday, and Coastal Flood Watches are up in northeast Florida. A High Surf Advisory covers Palm Beach. [37]
Hurricane Vance, E. Pacific (NHC, 05:00 ET): Vance is now a hurricane, 440 miles south-southwest of Acapulco, with 85 mph winds, moving north-northwest at 6 mph. NHC forecasts rapid intensification to a major hurricane by tonight. Swells will reach southern Mexico this weekend. No coastal watches are in effect. [36]
Typhoon Champi (Rosal), Taiwan and Japan: At 09:00 Taiwan time, Champi was 320 km east-southeast of Eluanbi, with 155 km/h winds and gusts to 191 km/h. Its eye is expected over waters northeast of Taiwan late Friday night, and heavy rain will last through Saturday morning. [29] Schools and offices are closed in almost every county. One person has died, 171 are injured and about 1,000 have been evacuated. Up to 90 cm of rain is possible in the northeast. Champi then tracks toward Okinawa and Japan’s main islands. Reported by BBC News. [28]
Tradecraft Tip (general guidance, not tailored advice)
Vet the armed people around your principal as carefully as the threats against them. This week’s GWB case involves an armed retiree working in executive security. For every armed driver or agent, confirm the license status and the carry authority that applies in each state you’ll pass through. Make sure they have recent de-escalation and use-of-force training. Set a clear rule: road conflicts are avoided, never engaged. Make your company’s post-incident steps explicit: stop, report, and preserve dashcam footage. Leaving the scene of a shooting turns one incident into two problems. Review this every year and whenever someone new joins the detail.
Coming Up
Friday, Oct. 23: The President holds a rally at Alico Arena (FGCU), Fort Myers, Fla., at 14:00 ET. Doors open at 10:30. He then flies to Palm Beach. [39][40] Check FAA TFRs if your principal flies nearby.
Saturday, Oct. 24: Paris march from Bastille to Nation at 14:00. Yellow Vests gather at Bastille from 12:00, and the Bastille–Opéra route is banned. [24][25]
Saturday, Oct. 24: The President holds a rally at Guardian Centers, Perry, Ga., at 19:00 ET. Doors open at 15:30, with airport-style screening. [41][42]
Sources
Arab News, updated Oct. 23 — https://www.arabnews.com/saudi-arabia/coalition-air-defenses-down-missile-bound-for-riyadh-amid-ongoing-houthi-attacks-3007832
Middle East Eye live blog, Oct. 23, 02:31 BST — https://www.middleeasteye.net/live-blog/live-blog-update/alerts-issued-saudi-arabias-riyadh-and-najran-saudi-led-coalition-says
Dawn (agencies), Oct. 23 — https://www.dawn.com/news/2039176/houthi-attacks-on-saudi-sites-claim-four-more-lives
Reuters (via Investing.com), updated Oct. 22 — https://www.investing.com/news/commodities-news/saudi-aramco-tells-staff-to-evacuate-dhahran-as-clashes-with-yemens-houthis-continue-4965766
Gulf News (AFP), Oct. 22 — https://gulfnews.com/world/gulf/saudi/saudi-aramco-orders-full-evacuation-of-dhahran-headquarters-amid-houthi-attacks-1.500719958
U.S. Embassy & Consulates in Saudi Arabia, Security Alert Oct. 21 (latest posted) — https://sa.usembassy.gov/security-alert-u-s-mission-to-saudi-arabia-october-21-2026/
U.S. Department of State, Saudi Arabia Travel Advisory (Level 3, issued Oct. 12) — https://travel.state.gov/content/travel/en/traveladvisories/traveladvisories/saudi-arabia-travel-advisory.html
Aerospace Global News, Oct. 22 — https://aerospaceglobalnews.com/news/riyadh-flights-al-qassim-airport-bus-transfers/
CBS New York, updated Oct. 22 — https://www.cbsnews.com/newyork/news/suspect-in-deadly-george-washington-bridge-shooting-appears-in-court/
Gothamist, Oct. 22 — https://gothamist.com/news/former-cop-who-fatally-shot-a-man-on-the-george-washington-bridge-held-on-1-million-bail
ABC News, Oct. 22 — https://abcnews.com/US/retired-nyc-police-detective-pleads-not-guilty-manslaughter-charge/story?id=137476876
CBS New York, updated Oct. 22 — https://www.cbsnews.com/newyork/news/woman-stabs-man-midtown-manhattan-nypd/
JTA / New York Jewish Week, Oct. 22 — https://www.jta.org/2026/10/22/ny/orthodox-jewish-man-stabbed-in-midtown-manhattan
CBS New York, updated Oct. 22 — https://www.cbsnews.com/newyork/news/new-york-city-subway-shooting-nypd-arrest/
ABC7 New York, Oct. 22 — https://abc7ny.com/post/nypd-marijuana-smoking-dispute-led-deadly-midtown-subway-shooting/19968228/
New York Post, Oct. 22 — https://nypost.com/2026/10/22/us-news/teen-charged-with-murder-for-allegedly-killing-beloved-nyc-security-guard-at-subway-station/
NBC DFW, Oct. 22 — https://www.nbcdfw.com/news/local/fbi-arrests-mckinney-teen-accused-plotting-assassinate-north-texas-keith-self/4094390/
UPI, Oct. 22 — https://www.upi.com/Top_News/US/2026/10/22/Pelosi-others-receive-suspicious-letter/1281792650008/
Office of Rep. Jan Schakowsky, Oct. 21 — https://schakowsky.house.gov/media/press-releases/schakowsky-statement-second-suspicious-letter-less-week
ABC News (Australia), Oct. 23 — https://www.abc.net.au/news/2026-10-23/helen-haines-candle-vigil-critical-injuries-hospital-update/107302886
7NEWS, Oct. 23 — https://7news.com.au/news/helen-haines-condition-revealed-in-health-update-as-police-probe-motive-behind-alleged-attack-c-23060510
franceinfo, Oct. 22 — https://www.franceinfo.fr/societe/mobilisation-du-17-octobre/la-manifestation-parisienne-autorisee-entre-bastille-et-nation-samedi_8248864.html
France 3 Paris Île-de-France, Oct. 22 — https://france3-regions.franceinfo.fr/paris-ile-de-france/paris/manifestation-du-24-octobre-a-paris-parcours-protection-des-commercants-securite-ce-que-l-on-sait-pour-la-journee-de-samedi-3437625.html
Leggo, Oct. 23 — https://www.leggo.it/italia/milano/23_ottobre_2026_milano_blindata_500_para_folgore_manifestazione_crosetto_taser_spray_sicurezza-9842280.html
Il Sole 24 Ore, Oct. 22–23 — https://www.ilsole24ore.com/art/militari-piazza-milano-arrivano-para-ecco-numeri-soldati-citta-e-cosa-potranno-fare-AJPOj6pB
BBC News, Oct. 23 — https://www.bbc.com/news/articles/cw98zn304zg7o
Focus Taiwan (CNA), Oct. 23 — https://focustaiwan.tw/society/202610230003
Focus Taiwan (CNA), Oct. 23 — https://focustaiwan.tw/society/202610230007
ConnectWise Trust Center advisories (updated Oct. 23, 01:00 UTC) — https://www.connectwise.com/company/trust/advisories
CISA, Oct. 21 — https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching
The Hacker News, Oct. 23 — https://thehackernews.com/2026/10/php2shell-exploit-attempts-hit-millions.html
CISA Known Exploited Vulnerabilities Catalog (live) — https://www.cisa.gov/known-exploited-vulnerabilities-catalog
National Hurricane Center, Post-Tropical Cyclone Josephine Advisory 5 (final), Oct. 22 — https://www.nhc.noaa.gov/text/MIATCPAT5.shtml
National Hurricane Center, Hurricane Vance Advisory 8, Oct. 23 — https://www.nhc.noaa.gov/text/MIATCPEP2.shtml
National Weather Service, active alerts NY/NJ/NC/FL (live) — https://api.weather.gov/alerts/active?area=NY,NJ,NC,FL
National Weather Service, New York City forecast (live) — https://api.weather.gov/gridpoints/OKX/33,42/forecast
WINK News, Oct. 23 — https://www.winknews.com/news/southwest_florida/president-trump-expected-in-fort-myers-today-as-midterm-campaign-enters-final-stretch/article_59af061e-066f-4037-a15e-acef3275bceb.html
White House Pool schedule, Oct. 23 — https://pool.pp.tools/schedule
13WMAZ, Oct. 22 — https://www.13wmaz.com/article/news/local/trump-rally-in-perry-tickets-security-arrival-times/93-2639b1bb-4295-4e7e-a47f-509a0fea44f8
Roll Call Factba.se calendar (live) — https://rollcall.com/factbase/trump/calendar/
Breaking alerts post first on X @EPDailyBrief, with more on Instagram and Threads @executiveprotectiondaily.
Need a custom security brief for an event or trip? Request one here.
Open-source reporting only; verify before acting.