Correction (Oct. 20, 2026): An earlier version of this brief said police detained a 17-year-old in the shooting at actor Tiger Shroff’s car. Mumbai Police said Monday that none of the three accused is a minor. All three were arrested at Kota and handed to Mumbai Police on transit remand. (Sources: The Hindu; Times of India/PTI.)
Bottom Line Up Front
UK activists are targeting defense-industry staff at their homes. A group calling itself The List has vandalized homes and cars of employees linked to Elbit Systems suppliers in Hampshire and Scotland, and claims to hold a bank of addresses gathered through “research, hacking, whistleblowers and leaks.” Counterterrorism officers are reportedly assisting local police. [1][2]
Riyadh’s airport is still largely shut down. By 13:05 local time Monday, a flight tracker showed 267 of 523 flights cancelled and none departed or arrived. On Sunday, U.S. missions across the Middle East warned that Iran and groups supportive of Iran may target U.S. businesses and other U.S.-linked sites worldwide. [11][12][13]
Two bomb threats hit aviation Sunday; both were cleared. Austrian Airlines OS82 (Tel Aviv–Vienna) diverted to Sofia with a fighter escort, and a bomb-threat call slowed traffic into Palm Beach’s main airport for about an hour. [6][7][19][20][21]
Unrest continued Sunday in Paris, Milan and Tirana. Italy’s prime minister has called a public-order meeting for today after a second day of looting in central Milan. [15][16][17]
Mumbai update: Three suspects were arrested and none is a minor in the shooting at actor Tiger Shroff’s car. Investigators suspect the attackers studied his regular Sunday football visits before striking. [3][4]
For solo operators: If your principal has a fixed weekly activity (a game, a class, a standing dinner), change the timing or the route this week, since the Mumbai attack appears to have been built around one. [4] In Milan, keep principals away from Piazza Duomo, Via Torino, the Galleria and the Moscova nightlife area in the evenings until the city settles down. [16] In Paris, avoid Place de la République and any short-notice gathering called on social media. [15]
For corporate security teams: Briefing items for leadership: (1) if your company supplies the defense sector, especially Israel-linked programs, check how easily employees’ home addresses can be found and tell staff to report vandalism or anyone watching their homes, [1][2] (2) U.S. missions say U.S. businesses could be targets anywhere, so review travel to the Gulf and plan any Riyadh movement around a closed or barely operating airport, [11][12][13] (3) if your company uses ConnectWise Cloud Backup, have IT disable (not delete) its apps in Microsoft 365 and check every app for credentials added since Oct. 13. [23]
Threats to Executives & Public Figures
United Kingdom (defense-sector employees): The List, a pro-Palestinian group, has published images of nighttime attacks on the homes of people who work for defense firms, warning employees to “quit your job, or risk a visit.” Reported by The Sunday Times and The Jewish Chronicle. [1][2]
In Fleet, Hampshire, police were called on Oct. 10 after red paint was thrown across the front of a house and two car tires were damaged at about 3:30 a.m. The home belongs to an executive at Ultra Intelligence & Communications, a reported Elbit supplier.
In Dunfermline, Fife, a hooded figure sprayed red paint over three vehicles at the home of a Leonardo UK engineer. On the same night, the South Queensferry home of a Keysight Technologies executive was targeted.
The group says it has targeted more than half a dozen senior employees, posts its material on a website registered in Iceland and asks supporters to contact it through the encrypted app SimpleX. Police Scotland and Hampshire police are investigating, and counterterrorism officers are understood to be assisting.
Analyst note: The Times notes the engineer is not a company director, so the address would not appear in public company filings. It may have been found by following them home or through social media. Executives aren’t the only staff at risk.
Mumbai, India (Tiger Shroff shooting), update: A joint Rajasthan Anti-Gangster Task Force and Kota police team arrested three suspects, none a minor, at Kota on Monday, acting on Mumbai Police inputs. Two more people have been detained. The case, an attempted-murder FIR, has moved to the Mumbai Crime Branch. The Lawrence Bishnoi gang has claimed responsibility and issued new threats against people who work with actor Salman Khan. Reported by India Today. [3]
Investigators suspect the attackers knew Shroff regularly visited the Juhu football ground on Sundays and struck as he left. They fled on a motorcycle, abandoned it at Andheri station, and boarded a train. Reported by The Times of India (ANI). [4]
Analyst note: A three-person team with a getaway rider and a planned escape route points to surveillance before the attack. See today’s Tradecraft Tip.
Suspicious mailings (U.S.), update: Sen. Adam Schiff said Sunday that U.S. Capitol Police and the Senate Sergeant at Arms intercepted at least one envelope containing “a suspicious substance” addressed to one of his California offices. Dozens of members of Congress from both parties have now been targeted, including Sens. Ted Cruz, Susan Collins, Mike Rounds and Pete Ricketts. Reported by UPI. [5]
West Palm Beach, Fla.: The Palm Beach County Sheriff’s Office (PBSO) confirmed a bomb threat at Donald J. Trump International Airport (formerly Palm Beach International) on Sunday afternoon. Deputies slowed traffic into the terminal, and nothing was found. The airport said roadways reopened and operations returned to normal about an hour after its 1:20 p.m. notice. Authorities have not connected the threat to the airport’s new name. Reported by WPTV and WPBF. [6][7]
Washington, DC (Capitol Hill): Around 11:10 p.m. Sunday in the 400 block of 8th St. SE near Eastern Market, a man in a sidewalk fight fired at National Guard members who had stepped in to break it up. Three Guard members returned fire. One Guard member was shot in the leg and the suspect in the abdomen. Both are expected to survive, and the suspect is in custody. MPD says there is no further threat. Reported by WJLA. [8]
Northern Ireland: An email claiming “an explosive device” was in 160 schools prompted some schools to close or evacuate Monday morning. Education Minister Paul Givan said it is not being treated as a viable threat. PSNI says it is making urgent enquiries. Reported by BBC News NI. [9][10]
Analyst note: Mass threat emails hit many sites at once. Decide in advance who on your team judges whether an emailed threat is credible, so a site doesn’t empty its building onto the street just because of the email.
Travel Advisories & Hotspots
Middle East (U.S. missions, Oct. 18): Coordinated alerts from U.S. missions, including Saudi Arabia, the UAE, Oman, Iraq and Jerusalem, tell Americans to “exercise heightened vigilance.” They warn that Houthi attacks on Saudi civilian airports and infrastructure “have the potential to escalate rapidly.” They also warn that Iran and groups supportive of Iran “may target other U.S. interests overseas... including U.S. businesses.” [11][12]
U.S. government staff in Saudi Arabia need special authorization to use Riyadh’s King Khalid airport and may not travel within 20 miles of the Yemen border. [11]
The alerts advise staying away from glass doors, windows and debris during an aerial attack, keeping a low profile, and staying alert at places publicly associated with the U.S. [11][12]
Riyadh: As of 13:05 local time Monday, RUH Watch listed 267 of the day’s 523 flights as cancelled, none departed or arrived, and 254 awaiting update. [13]
Civil Unrest in Business Hubs
Milan, Italy (day 2): On Sunday, hundreds of young people in small, mostly black-clad groups of 10 to 20 moved from Piazza Duomo to Via Torino. They looted a Carrefour, Levi’s and Under Armour on Via Orefici, the Decathlon near Sforza Castle and a Vodafone store on Corso Garibaldi. Venues were damaged and shops looted in the Moscova nightlife district. Police used tear gas and water cannons. The Duomo closed early to tourists, and the Duomo metro station was shut as a precaution. Galleria bars including Biffi, Savini, Camparino and Cracco took in their outdoor seating. More than 200 people were detained, about 80% of them minors. Prime Minister Giorgia Meloni called a public-order meeting for today. Reported by Il Sole 24 Ore. [16]
Paris, France: Several hundred people gathered at Place de la République on Sunday after social-media calls for an unapproved rally. A clothing store was looted and bikes were set alight nearby. Police fired tear gas and stun grenades and made several arrests. After Saturday, about 550 of the 855 people arrested in Paris remained in detention, and the retail federation estimates about 1,500 businesses were damaged. Lyon’s city-center tourist office was set ablaze, and Limoges lost its 19th-century town hall to a deliberately set fire. Reported by France 24 (AFP). [15]
Tirana, Albania (day 6): Hundreds again confronted police outside the Education Ministry on Sunday. Police used rubber bullets, water cannons and tear gas. Downtown shops have pulled down metal shutters, and city workers removed paving stones so they couldn’t be thrown. The Health Ministry reported 65 injured Sunday (37 police) and 272 injured since Tuesday (169 police). PM Edi Rama has refused to resign. Reported by Al Jazeera. [17]
Aviation & Transport
Austrian Airlines OS82 (Tel Aviv–Vienna): Near the Romanian border Sunday evening, the crew reported a bomb-threat signal and diverted to Sofia. A Bulgarian Air Force fighter escorted the jet in, and passengers were taken off the aircraft. [20] The airline confirmed “a threat against flight OS82” and said a search of the aircraft, passengers and crew found no danger. The A320 had 51 passengers and six crew. It landed at 8:42 p.m. local time and continued to Vienna that night with all passengers. Reported by NBC News (Reuters) and The Jerusalem Post. [19][21]
Context: Last month, a pilot attempted to hijack a Flydubai flight bound for Tel Aviv. Reported by the BBC. [18]
Riyadh carriers: Reported by What’s On Saudi Arabia. [14]
Etihad has extended Abu Dhabi cancellations to Dammam, Jeddah and Riyadh through Saturday, Oct. 24, and IndiGo has cancelled Riyadh, Jeddah, Dammam and Madinah through Oct. 24.
Oman Air has suspended Riyadh through Oct. 22.
Emirates, Gulf Air and Kuwait Airways say Riyadh flights stay cancelled until the airport resumes operations.
Cathay Pacific has suspended Riyadh until Jan. 31, 2027.
Qatar Airways (Riyadh, Dammam), Air Arabia and PIA have not announced resumption dates.
U.S.: As of 10:07 UTC (6:07 a.m. ET), the FAA listed no ground stops or delay programs at U.S. airports. [22]
Cyber & Doxxing Risk to Principals
ConnectWise Cloud Backup (Microsoft 365), update: Reported by iTnews. [23]
Huntress has now found almost 1,000 tenants with sign-in activity from the attacker’s address, in addition to 162 confirmed unauthorized sign-ins.
In one tenant, a second ConnectWise app gave itself global administrator rights. It then added new passwords, valid until 2028, to two other apps, which would let an attacker return after the original credential was cancelled.
A separate wave targeted 16 tenants in the policy, national security, trade and critical-minerals sectors. Those attempts failed.
ConnectWise says it has seen no sign that stored backups were accessed, but it cannot tell whether any customer’s tenant was entered. Backups stay offline until further notice.
Home addresses as an attack surface: The List says it built its target lists through “research, hacking, whistleblowers and leaks.” [1][2]
Action: Disable, don’t delete, ConnectWise apps and audit app credentials added since Oct. 13. [23] For staff in sensitive roles, run a data-broker and social-media sweep for home addresses, vehicle photos and routine check-ins.
Severe Weather
Northeast U.S. (NWS): A Frost Advisory covers Orange and Putnam counties in New York, western Passaic County in New Jersey and northern Connecticut until 8 a.m. [24] NYC will be sunny with a high near 64, with north winds of 14–17 mph Tuesday and no rain in the forecast through Thursday. [25]
Florida (NWS): High Surf Advisories and Rip Current Statements cover much of the Atlantic coast. In coastal Palm Beach County, the surf advisory runs until 8 a.m. Wednesday. A Coastal Flood Advisory covers Flagler and St. Johns counties through 8 p.m. Tuesday. [26]
Southern California (NWS): Beach Hazards Statements remain in effect for the Ventura, Malibu, LA, Orange and San Diego coasts through 9 a.m. PT Tuesday. [27]
Tropical Storm Trudy (E. Pacific, NHC): As of 0900 UTC, Trudy had weakened to 60 mph about 155 mi WSW of Cabo Corrientes and was moving west at 6 mph. No coastal watches or warnings are in effect. NHC expects it to become post-tropical tonight, but swells will keep causing life-threatening surf and rip currents along southwestern and west-central Mexico today. [28]
Typhoon Champi (W. Pacific):
Philippines: Champi had 175 km/h winds about 1,600 km east of southeastern Luzon Monday. It is expected to enter the Philippine Area of Responsibility (where it will be named Rosal) Tuesday and may re-intensify into a super typhoon. Wind Signals 3–4 are possible for northern and eastern Northern Luzon and parts of Bicol. Hazardous seas are expected on Luzon’s northern and eastern seaboards from Wednesday. Reported by The Manila Times (PAGASA). [29]
Taiwan: Taiwan’s Central Weather Administration said a sea warning could come as early as Wednesday night. The heaviest impact is expected Friday and Saturday, though the track is still uncertain. Reported by Focus Taiwan (CNA). [30]
Tradecraft Tip (general guidance, not tailored advice)
Routine is what attackers plan around. Both of today’s lead threat stories depended on knowing where someone would be. In Mumbai, investigators suspect the attackers timed the shooting to a weekly football session. In the UK, activists found the homes of employees who aren’t listed in any company filing. Make a list of your principal’s fixed weekly activities and check what is public about each one, such as team rosters, club sites, family social media and gym check-ins. For anything you can’t move, vary the arrival time, the vehicle and the exit, and post a set of eyes outside before your principal arrives.
Week Ahead (Oct. 19–25)
New York:
Paley International Council Summit, Oct. 19–21: Media and business leaders meet at the Paley Museum in Midtown. [31]
Greenbuild, Oct. 20–23: The conference runs at the Javits Center (445 11th Ave. at 38th St.). [32]
Early voting: Starts Saturday, Oct. 24 (9 a.m.–5 p.m. in NYC) and runs through Nov. 1. [33]
Washington, DC region:
Marine Corps Marathon, Sunday, Oct. 25: The race starts at 7:20 a.m. on Route 110 in Arlington.
Road closures: Arlington closures run from about 3 a.m. to 6 p.m., and southbound Route 110 closes at 4 p.m. Saturday. [34]
Presidential travel (public schedule): Each stop is a political rally. Check FAA TFR listings if your principals fly into those areas. Reported by Roll Call Factba.se. [35]
Oct. 19: Park City, Kan.
Oct. 20: Greenville, N.C.
Oct. 21: Pendleton, S.C.
Oct. 22: Sioux City, Iowa
Oct. 23: Fort Myers, Fla.
Oct. 24: Macon, Ga.
Oct. 25: Port Huron, Mich.
International:
Belgrade: Student-led rally at Slavija Square on Thursday, Oct. 22, ahead of Serbia’s Oct. 25 parliamentary election. The U.S. Embassy warns of heavy police presence and road closures. [36]
Taiwan and northern Philippines: Typhoon Champi impacts are possible Wednesday through Saturday (see Severe Weather). [29][30]
Just past the window: FII10 runs Oct. 26–29 in Riyadh. Plan arrivals around the airport situation above. [37][13]
Sources
The Sunday Times, Oct. 17 — https://www.thetimes.com/uk/crime/article/counter-terror-police-investigation-pro-palestine-activists-kvsw62dcs
The Jewish Chronicle, Oct. 18 — https://www.thejc.com/news/uk/new-pro-palestine-group-targeting-homes-of-israeli-defence-firms-employees-in-the-uk-qexcuzj7
India Today, Oct. 19 — https://www.indiatoday.in/india/story/tiger-shroff-shooters-arrested-rajasthan-kota-lawrence-bishnoi-3020566-2026-10-19
The Times of India, Oct. 19 — https://timesofindia.indiatimes.com/city/mumbai/movements-monitored-recce-conducted-assailants-tracked-tiger-shroffs-sunday-football-visits-before-firing/articleshow/135044738.cms
UPI, Oct. 18 — https://www.upi.com/Top_News/US/2026/10/18/schiff-suspicious-envelope/7411792372249/
WPTV, Oct. 18 — https://www.wptv.com/news/palm-beach-county/bomb-threat-prompts-heavy-law-enforcement-response-near-trump-airport-in-west-palm-beach
WPBF, Oct. 18 — https://www.wpbf.com/article/florida-heavy-police-presence-reported-at-donald-j-trump-international-airport/74170871
BBC News NI, Oct. 19 — https://www.bbc.co.uk/news/articles/cw1m4pvdzzj0o
PSNI, Oct. 19 — https://www.psni.police.uk/latest-news/emails-sent-school
U.S. Mission to Saudi Arabia, Security Alert Oct. 18 — https://sa.usembassy.gov/security-alert-u-s-mission-saudi-arabia-october-18-2026/
U.S. Mission UAE, Security Alert Oct. 18 — https://ae.usembassy.gov/security-alert-u-s-mission-united-arab-emirates-october-18-2026/
RUH Watch, Riyadh flights Oct. 19 (13:05 local) — https://ruhwatch.com/en/
What’s On Saudi Arabia, Oct. 19 — https://whatsonsaudiarabia.com/2026/10/updated-flight-cancellations-in-riyadh/
France 24 (AFP), Oct. 18 (updated Oct. 19) — https://www.france24.com/en/live-news/20261018-paris-police-in-new-battles-with-protesters-and-looters
Il Sole 24 Ore, Oct. 18 — https://en.ilsole24ore.com/art/new-clashes-in-central-milan-meloni-calls-for-a-security-summit-AJViNbnB
Al Jazeera, Oct. 18 — https://www.aljazeera.com/news/2026/10/18/chaos-in-tirana-demonstrators-determined-to-not-give-up-so-easily
BBC News, Oct. 18 — https://www.bbc.com/news/articles/c680zdmn100lo
NBC News (Reuters), Oct. 19 — https://www.nbcnews.com/world/europe/austrian-airlines-flight-tel-aviv-diverts-bulgaria-threat-rcna604289
Bulgarian Ministry of Transport and Communications, Oct. 18 — https://www.mtc.government.bg/bg/category/1/samolet-s-marshrut-tel-aviv-viena-e-kacnal-v-sofiya-zaradi-signal-za-bombena-zaplakha
The Jerusalem Post, Oct. 19 — https://www.jpost.com/international/article-912100
FAA NAS Status (10:07 UTC) —
https://nasstatus.faa.gov/
iTnews, Oct. 18 (updated Oct. 19) — https://www.itnews.com.au/news/stolen-connectwise-skykick-credential-exposed-microsoft-365-tenants-629721
NWS active alerts, New York — https://api.weather.gov/alerts/active?area=NY
NWS forecast, New York City — https://forecast.weather.gov/MapClick.php?lat=40.7142&lon=-74.0059
NWS active alerts, Florida — https://api.weather.gov/alerts/active?area=FL
NWS active alerts, California — https://api.weather.gov/alerts/active?area=CA
NOAA National Hurricane Center, Trudy Advisory 24 — https://www.nhc.noaa.gov/text/MIATCPEP1.shtml
The Manila Times (PAGASA), Oct. 19 — https://www.manilatimes.net/2026/10/19/news/national/champi-to-re-intensify-into-super-typhoon-as-it-enters-par-pagasa/2448318
Focus Taiwan (CNA), Oct. 18 — https://focustaiwan.tw/society/202610180011
The Paley Center for Media — https://www.paleycenter.org/press-releases/pics-2026-announce
Greenbuild 2026, show information — https://informaconnect.com/greenbuild/show-information/
NYC Board of Elections — https://www.vote.nyc/election/general-election-early-voting-day-1
Arlington County, Marine Corps Marathon traffic alert — https://www.arlingtonva.us/About-Arlington/Newsroom/Articles/2026/TRAFFIC-ALERT-51st-Annual-Marine-Corps-Marathon
Roll Call Factba.se, President’s public schedule — https://rollcall.com/factbase/trump/calendar/
U.S. Embassy Belgrade, Demonstration Alert Oct. 16 — https://rs.usembassy.gov/demonstration-alert-u-s-embassy-belgrade-serbia-october-16-2026/
FII Institute, FII10 — https://fii-institute.org/conference/fii-10th-edition/
Breaking alerts post first on X @EPDailyBrief, with more on Instagram and Threads @executiveprotectiondaily.
Open-source reporting only; verify before acting.