Bottom Line Up Front
Saudi Arabia: ordered departure and more missiles. The State Department reissued its Saudi Arabia Travel Advisory on Oct. 23. It stays at Level 3 (Reconsider Travel) but now includes an ordered departure of non-emergency U.S. government staff and their families. [1][2][3] Overnight, the coalition says it intercepted a ballistic missile aimed at Riyadh shortly after 04:00 Saudi time (21:00 ET Friday), then two more aimed at Taif and Yanbu. [4][5]
Iranian targeting of Americans: An unclassified memo from Director of National Intelligence Jay Clayton to Secretary of State Marco Rubio says Iran has “substantially increased efforts to target U.S. personnel.” It says lethal plotting has “reached advanced stages in both the Middle East and certain other countries.” [6][7] The memo names no targets, countries or timeline.
Paris marches today on the imposed route. At 11:02 Paris time, the administrative court rejected the unions’ challenge, and organizers then accepted the Porte d’Italie–Porte de Vincennes route. Up to 110,000 people are expected. [15][16] Milan has 1,400 police and troops in the center, and there are calls online to gather at the Duomo at 15:00. [17][18]
Also today: The Trappes suspect and his mother are both in police custody. A 12-year-old girl was hit by eight bullets and was in life-threatening condition as of Friday evening. [13][14][44][45] Champi has weakened over Taiwan, where 1 person died and more than 520 were injured, and could approach Kyushu Monday. [27][28][29][30] Hurricane Vance holds at 110 mph and did not become a major hurricane. [38]
For solo operators: If your principal is in Paris today, stay off the Boulevards des Maréchaux between Porte d’Italie and Porte de Vincennes from 13:00 to 19:00 Paris time. Also keep clear of Place Jussieu from 14:00, and stay out of the République and Les Halles curfew zones from 23:00. [15][16] If your principal is flying anywhere in the Gulf or Russia this weekend, confirm each leg directly with the airline. [23][24]
For corporate security teams: Briefing items for leadership: (1) the U.S. ordered departure from Saudi Arabia and the DNI memo are reasons to review any U.S. staff or dependents in Saudi Arabia and the wider region, including their exit plans, [1][6] (2) Paris and Milan sites near today’s gatherings should run on weekend protest posture, [15][17] (3) the FBI’s suspicious-mail PSA now lists media organizations and polling companies among the targets, so mailrooms at those firms should apply it, [20] (4) Quest Diagnostics has confirmed a patient-data breach, so watch for phishing aimed at executives who use Quest. [32][33]
Threats to Executives & Public Figures
Iran plotting against U.S. personnel: CBS News obtained Clayton’s unclassified memo to Rubio. It says “the lethal plotting efforts by the Iranians against U.S. citizens have reached advanced stages in both the Middle East and certain other countries.” The intelligence is being downgraded so it can be shared with State Department staff. [6] A U.S. official confirmed the memo’s authenticity to Scripps News. [7] Neither outlet reports specific targets, locations or dates. Axios first reported the memo; we could not open the Axios article.
Analyst note: The memo refers to U.S. personnel and citizens broadly, not only diplomats. For principals with a public profile on Iran or the Gulf, treat this as an increase in baseline threat, not as a specific warning.
Action: Vary routes and timings, restrict advance publicity of travel, and review residence security for principals with Iran-related profiles.
Suspicious letters (follow-up): A new FBI/USPIS public service announcement (I-102326-2-PSA, Oct. 23) says letters with suspicious substances have been mailed to elected officials, secretaries of state and election offices. It also lists media organizations and public and private polling companies among the recipients. “To date, no hazardous material has been identified,” though lab testing continues. [20] Nearly every member of Maryland’s congressional delegation, as well as the state elections office, received letters with a nontoxic powder in the past week. [21] Officials in Ohio, New Hampshire, Pennsylvania and Connecticut say letters bound for their offices were intercepted. More than 100 letters have been sent nationwide. Reported by Votebeat. [22] No sender has been named and no arrest announced. [20][21]
Action: Use the PSA’s steps: PPE for mail handlers, do not shake or move the item, cover it, leave the room, close the door and call 911. [20]
Rep. Moskowitz threat and GWB case (follow-up): We found no new public details since Friday’s brief. The GWB grand jury is still scheduled for Monday, Oct. 26.
Travel Advisories & Hotspots
Saudi Arabia:
Advisory and ordered departure: The reissued advisory (dated Oct. 23) says: “On October 23, 2026, the Department of State ordered non-emergency U.S. government employees and U.S. government employee family members to leave Saudi Arabia due to safety risks.” U.S. government staff need special authorization to use any Saudi airport and to travel to Qatif, Taif, Yanbu, Jizan, Asir or Najran. They may not go within 20 miles of the Yemen border, which is Level 4. The advisory warns travelers not to photograph, film or share information about missile or drone interceptions. It lists Saudi Arabia Railways, SAT Transportation and SAPTCO as ground options. [1]
Where sources disagree: CBS and BBC reported the ordered departure on Wednesday, Oct. 21. CBS cites spokesperson Tommy Pigott, who said it covers “Saudi Arabia only.” The advisory text dates it Oct. 23. [1][2][3] CBS adds that other regional embassies are on “restricted operations.” [2]
Correction: Friday’s brief said the advisory was “last issued Oct. 12” and did not mention the ordered departure. That was wrong. The ordered departure had already been reported on Oct. 21. [2][3]
Overnight attacks: Shortly after 04:00 Saturday, alerts sounded in Riyadh, Najran and Wadi Al-Dawasir, and two loud blasts were heard in Riyadh. The coalition says it intercepted one ballistic missile aimed at Riyadh and a drone over the Eastern Province. Warnings were later issued and lifted for Jeddah, Yanbu, Taif and Makkah. Coalition spokesman Brig. Gen. Turki Al-Maliki said two ballistic missiles aimed at Taif and Yanbu were intercepted. [4][5]
Aramco: We found no new Aramco statement as of 06:00 ET.
Iran and the Gulf:
Strike timing: Tom Barrack, the U.S. Ambassador to Türkiye, said on a podcast: “Could there be a strike this weekend? Absolutely.” President Trump said, “I don’t know anything about it.” [8][9]
IRGC mine claim: The IRGC Navy says two supertankers carrying more than 4.5 million barrels of crude hit mines on an “unauthorized” southern route through the Strait of Hormuz and were abandoned by their crews. It gave no ship names or flags. Trump accuses Tehran of fabricating such incidents. Treat this as an IRGC claim only. [10][11]
Undersea cables: Iran is reported to be planning to target Gulf undersea cables if the war resumes. Reported by Reuters (two officials) via Gulf News; unconfirmed. [5]
Action: For Gulf travel this weekend, keep a ground exit plan current and register principals with STEP.
Civil Unrest in Business Hubs
Paris, today:
Route: At 11:02 Paris time (05:02 ET), the administrative court rejected the unions’ référé, so the prefecture’s route stands: Porte d’Italie to Porte de Vincennes via the Boulevards des Maréchaux. At 11:41, CGT Paris co-leader Karl Ghazi said organizers would “suivre le parcours imposé” (follow the imposed route). [15][16]
Banned route and second rally: The Yellow Vest/student route from Bastille to Opéra via République is banned. A second rally is called for 14:00 at Place Jussieu (5th), with departure at 15:00. [15]
Security measures: The prefecture expects up to 110,000 people. Up to 14 drones may fly from 07:00 to 23:59. Gendarmerie Centaure armored vehicles are posted near the Élysée. [15]
Disruption: In the 13th arrondissement, the tram is suspended, gardens and sports facilities near the route are closed, and parking is banned. Several shops on rue du Faubourg-Saint-Antoine have boarded up. The 23:00–06:00 curfew around République and Les Halles is extended to Monday morning, Oct. 26. In Val-de-Marne, restrictions apply around five shopping centers this weekend. [15]
Where outlets disagree: The prefecture’s order allows the march from 13:00 to 19:00. The 13th-arrondissement mayor says it departs Porte d’Italie at 14:00, and BFMTV says 14:00–19:00. [15][16]
Action: Avoid the southern and eastern edge of Paris and the 5th arrondissement this afternoon. Expect splinter groups to head toward the banned Bastille–Opéra corridor.
Milan, today:
Security posture: 1,400 police, carabinieri, Guardia di Finanza, local police and military personnel are posted in the center. Groups near the Duomo are being checked from early morning. Prosecutors have a 10-magistrate task force on standby. [17]
Authorized events: Only two morning presidi are authorized, plus a static Pro-Palestinian rally of 300–400 people in Piazza Leonardo da Vinci, away from the center. The Duomo area is off limits. [17][18]
Unofficial gathering: Unidentified groups on social media are calling for people to gather at the Duomo at 15:00 (09:00 ET). Anarchists have cancelled a planned march. [18]
Searches and armored vehicles: Police carried out more than 150 searches in Milan and 20 other cities after finding a suspicious chat. Lince armored vehicles are in Piazza Duomo. Shops in central Bologna are boarding up windows. Reported by Il Messaggero. [19]
Trappes and La Verrière, France (follow-up):
Custody: Suspect Kévin T., 39, of Plaisir, is in custody. Per the anti-terror prosecutor (PNAT), he was arrested in Coignières at 10:20 Friday. He had not been questioned yet because the search of his booby-trapped apartment required his presence. [13][14]
Casualties: PNAT counts 1 dead and 5 wounded, whose condition is “not stabilized.” As of Friday evening, a 12-year-old girl’s life was in danger. [12][13][44]
Mother in custody: The suspect’s mother has been placed in custody after going to police herself. [44][45] franceinfo reports she is 66. [13] No formal charges (mise en examen) had been reported as of 06:00 ET Saturday.
Where outlets disagree: franceinfo, 20 Minutes and BFMTV put the start of the shooting at about 10:30. Our Friday evening update cited PNAT as saying about 10:00. [12][14][45]
Aviation & Transport
Gulf airlines (Saudi routes): Etihad has cancelled Abu Dhabi flights to Dammam, Jeddah and Riyadh through Nov. 5. flydubai has suspended Riyadh, Dammam and Abha until Oct. 29. Emirates has cancelled some Saudi flights. Reported by Gulf News; confirm with the airline. [23]
Russia (drone restrictions): Rosaviatsia imposed temporary flight restrictions at 21 airports overnight and this morning, and 13 remained in effect late morning, including Kazan, Samara and Ufa. Flight boards showed 718 delays and 160 cancellations, with Sheremetyevo, Pulkovo and Vnukovo worst hit. [24] Vesti reports more than 10 airports suspended operations. [25] On Friday, restrictions covered all Moscow airports. [26]
Taiwan (Champi): Taoyuan Airport cancelled 563 flights Friday and 261 by 10:15 Saturday. Operations are recovering gradually. Penghu resumed flights Saturday afternoon. More than 1,000 travelers were stranded at each of the Kinmen and Penghu airports. [27]
Japan (Champi): Flights are cancelled, mainly between islands in Okinawa and Kagoshima prefectures. [29]
U.S.: The FAA’s national airspace status showed no ground stops or ground delay programs at major airports as of 06:05 ET. [31]
Cyber & Doxxing Risk to Principals
Quest Diagnostics breach: In an SEC 8-K, Quest says it learned on Oct. 21 of unauthorized access to its Quanum Lab Services Manager system. It believes “an unauthorized party accessed certain patient records” and has notified federal law enforcement. [32] TechCrunch reports that about 500,000 clinicians use Quanum. [33]
Action: Expect phishing and pretext calls that use medical details. Tell principals and their families to verify any “lab results” call or text through the provider’s known number.
PHP2Shell (follow-up): There is still no confirmed successful compromise. Sansec now says public exploits fail against default PHP setups. VulnCheck says it has an exploit that bypasses ASLR, available only to its customers. The UK government says 32 services were taken offline, mostly as a precaution. Patch to 8.5.12, 8.4.27, 8.3.36 or 8.2.35. [35]
ConnectWise Cloud Backup (formerly SkyKick), follow-up: As of the Oct. 23 14:00 UTC (10:00 ET) update, ConnectWise expects to finish testing by the end of this weekend. It expects backup restoration access early next week, followed by phased re-enrollment. Keep affected app connections disabled until ConnectWise says otherwise. [34]
CISA KEV: Two flaws under active exploitation were added Oct. 23. They are Arista VeloCloud Orchestrator SQL injection (CVE-2026-114625) and a Collabora Online built-in CODE Server command injection (CVE-2026-110447). [36][37]
Severe Weather
New York and New Jersey (NWS): NYC will be partly sunny today with a high near 63, clear tonight with a low around 44, and sunny Sunday with a high near 66. [41] A Freeze Warning covers Morris, Hunterdon and Somerset counties, N.J., until 09:00. Frost Advisories cover Southern Westchester, eastern Suffolk and much of central and southern N.J. until 09:00. A Coastal Flood Advisory covers Ocean County, Inland Sussex and the Delaware beaches until 18:00. A Coastal Flood Statement covers Southern Nassau until 09:00. [40]
Florida, Georgia and California (NWS): Coastal Flood Warnings run until 20:00 Monday along Florida’s Atlantic coast from Martin County north to coastal Glynn and Camden, Ga., and in the Upper Keys until 05:00 Sunday. Coastal Flood Warnings cover coastal San Diego and Orange counties, Calif., through Oct. 29. [42]
Southwest (NWS): Flood Warnings and Watches cover parts of Colorado, New Mexico, Arizona, Utah and far west Texas into Sunday. [42]
Hurricane Vance, E. Pacific (NHC Advisory 12, 05:00 ET): Vance is about 365 miles south-southwest of Acapulco, with 110 mph winds and a pressure of 965 mb, moving north-northwest at 7 mph. It did not reach major-hurricane strength as forecast Friday, and gradual weakening is expected from tonight. No coastal watches are in effect. Life-threatening surf and rip currents will reach southern and southwestern Mexico this weekend. [38]
Atlantic (NHC): No tropical cyclones are expected to form in the next 7 days. [39]
Champi, Taiwan and Japan:
Taiwan: Officials report 1 dead and more than 520 injured (527 per Reuters). [28][29] Focus Taiwan now calls Champi a tropical storm, and its headlines report that the land warning has been lifted. [27]
Japan: At 09:00 Japan time, the Japan Meteorological Agency still classed it as a typhoon, about 50 km north-northeast of Yonaguni, with 108 km/h winds and gusts to 162 km/h. It could approach Kyushu Monday morning and become extratropical by Tuesday. Owase, in Mie, recorded 302 mm of rain in 12 hours. [30]
Okinawa: More than 13,000 homes in Okinawa were without power, and Hateruma’s water supply was cut off. [29]
Where sources disagree: Taiwan calls Champi a tropical storm, while Japan still calls it a typhoon. [27][30]
Tradecraft Tip (general guidance, not tailored advice)
When a government pulls its own people out, treat it as your decision point, not as background news. An ordered departure means the government has judged the risk too high for its non-essential staff and their families. Your principal does not get the embassy’s support, armored transport or special flights. For any principal in or heading to that country, confirm a ground exit route now, using the options the advisory lists. Keep passports and visas for the neighboring country ready. Agree in advance on what will trigger leaving: for example, an airport closure, a strike in your city, or an embassy alert. Register with STEP and save the embassy’s emergency numbers. Confirm what your insurer and evacuation provider will cover before you need it.
Coming Up
Saturday, Oct. 24: The Paris march runs Porte d’Italie to Porte de Vincennes, 13:00/14:00–19:00 Paris time, with a Place Jussieu rally at 14:00. Milan’s unofficial Duomo call is for 15:00. [15][16][18]
Saturday, Oct. 24: The President holds a rally at Guardian Centers, Perry, Ga. Doors open at 15:30 and remarks begin at 19:00 ET, per the event page. [43] Check FAA TFRs if your principal flies nearby.
Monday, Oct. 26: The GWB case goes before a grand jury. Champi could approach Kyushu. ConnectWise backup restoration is expected early in the week. [30][34]
Sources
U.S. Department of State, Saudi Arabia Travel Advisory (Level 3, issued Oct. 23) — https://travel.state.gov/content/travel/en/traveladvisories/traveladvisories/saudi-arabia-travel-advisory.html
CBS News, Oct. 21 (updated 19:28 EDT) — https://www.cbsnews.com/news/us-saudi-arabia-ordered-departure-houthis/
BBC News, Oct. 22 — https://www.bbc.com/news/articles/c6x2vpk93770o
Arab News (with AFP), updated Oct. 24 — https://www.arabnews.com/saudi-arabia/coalition-forces-down-missile-and-drone-as-houthis-keep-up-strikes-on-saudi-arabia-3007971
Gulf News live, updated Oct. 24 — https://gulfnews.com/world/mena/middle-east-war-houthi-missile-targets-riyadh-tankers-hit-mines-near-hormuz-1.500721804
CBS News, Oct. 23 — https://www.cbsnews.com/news/iran-target-u-s-personnel/
Scripps News, Oct. 23 — https://www.scrippsnews.com/us-news/iran-war/new-memo-to-secretary-marco-rubio-warns-iran-is-working-to-target-us-personnel
Anadolu Agency, Oct. 23 — https://www.aa.com.tr/en/americas/us-envoy-suggests-iran-strikes-possible-this-weekend-trump-says-hes-unaware/4099059
CNA (AFP), Oct. 24 — https://www.channelnewsasia.com/world/iran-war-us-could-strike-soon-6488231
Anadolu Agency, Oct. 23 — https://www.aa.com.tr/en/middle-east/iran-s-revolutionary-guards-say-2-supertankers-hit-naval-mines-in-strait-of-hormuz/4099071
Rudaw, Oct. 24 — https://rudaw.net/english/categories/iran/1079863
franceinfo, Oct. 23 (updated 19:12 Paris) — https://www.franceinfo.fr/faits-divers/terrorisme/attaque-a-trappes/ce-que-l-on-sait-de-kevin-t-l-homme-de-39-ans-soupconne-de-l-attaque-terroriste-qui-fait-un-mort-et-plusieurs-blesses-graves-a-trappes-et-la-verriere_8250916.html
20 Minutes live, Oct. 23 — https://www.20minutes.fr/faits_divers/4256965-20261023-direct-fusillade-yvelines-suspect-garde-vue-parquet-antiterroriste-saisi
actu.fr Paris live, Oct. 24 — https://actu.fr/ile-de-france/paris_75056/direct-manifestation-du-24-octobre-a-paris-nouvelles-tensions-redoutees-apres-les-violences-suivez-la-situation_64964497.html
Corriere della Sera (Milano), Oct. 24 — https://milano.corriere.it/notizie/cronaca/26_ottobre_24/il-sabato-piu-lungo-di-milano-in-centro-schierati-1-400-agenti-controlli-fin-dal-mattino-e-fermi-preventivi-6aff052f-3386-47ae-bbfd-5893608d6xlk.shtml
Il Messaggero live, Oct. 24 — https://www.ilmessaggero.it/italia/manifestazione_milano_oggi_diretta_scontri_torino_bologna_firenze-9845782.html
FBI/USPIS PSA I-102326-2-PSA (IC3), Oct. 23 — https://www.ic3.gov/PSA/2026/PSA261023-2
Maryland Matters, Oct. 24 — https://marylandmatters.org/2026/10/24/maryland-members-of-congress-elections-officials-targeted-by-suspicious-letters/
Votebeat via northcentralpa.com, Oct. 23 — https://www.northcentralpa.com/features/more-than-100-suspicious-letters-sent-to-election-officials-nationwide-including-in-pennsylvania/article_80e504bc-a82d-4407-8681-66bf3fc325ad.html
Gulf News, Oct. 24 — https://gulfnews.com/business/aviation/uae-flight-updates-oct-24-cancellations-delays-and-saudi-travel-advisories-1.500721707
Airports.ru, Oct. 24 — https://airports.ru/en/post/flight-delays-2026-10-24/
Vesti, Oct. 24 — https://www.vesti.ru/ns/bolee-10-aehroportov-v-rossii-priostanovili-rabotu
Vedomosti, Oct. 23 — https://www.vedomosti.ru/society/news/2026/10/23/1239795-rosaviatsiya-vvela-ogranicheniya
Focus Taiwan (CNA), Oct. 24 — https://focustaiwan.tw/society/202610240012
CNA (Reuters), Oct. 24 — https://www.channelnewsasia.com/east-asia/taiwan-counts-1-dead-and-527-injured-after-typhoon-champi-sweeps-past-6488446
NHK World, Oct. 24 — https://www3.nhk.or.jp/nhkworld/news/20261024de64680/
The Japan Times (Jiji), Oct. 24 — https://www.japantimes.co.jp/news/2026/10/24/japan/typhoon-champi-saturday/
FAA National Airspace System Status (live, checked 06:05 ET Oct. 24) — https://nasstatus.faa.gov/api/airport-status-information
Quest Diagnostics, SEC Form 8-K, filed Oct. 22 — https://www.sec.gov/Archives/edgar/data/1022079/000094787126000941/ss6979200_8k.htm
TechCrunch, Oct. 23 — https://techcrunch.com/2026/10/23/lab-testing-giant-quest-diagnostics-confirms-patients-personal-and-health-data-was-compromised-during-breach/
ConnectWise Trust Center, updated Oct. 23, 14:00 UTC — https://www.connectwise.com/company/trust/advisories
SecurityWeek, Oct. 23 — https://www.securityweek.com/mirai-botnet-operators-join-php2shell-attacks-as-aslr-bypass-exploits-emerge/
CISA, Oct. 23 — https://www.cisa.gov/news-events/alerts/2026/10/23/cisa-adds-one-known-exploited-vulnerability-catalog
CISA, Oct. 23 — https://www.cisa.gov/news-events/alerts/2026/10/23/cisa-adds-one-known-exploited-vulnerability-catalog-0
NHC, Hurricane Vance Advisory 12, Oct. 24 — https://www.nhc.noaa.gov/text/MIATCPEP2.shtml
NHC, Atlantic Tropical Weather Outlook, Oct. 24 — https://www.nhc.noaa.gov/text/MIATWOAT.shtml
NWS active alerts, NY/NJ (live, Oct. 24) — https://api.weather.gov/alerts/active?area=NY,NJ
NWS New York forecast, NYC (live, Oct. 24) — https://api.weather.gov/gridpoints/OKX/33,42/forecast
NWS active alerts, nationwide (live, Oct. 24) — https://api.weather.gov/alerts/active
GOP.com event page, Perry, Ga. rally (live) — https://events.gop.com/events/midterm-rally-in-macon-ga-president-donald-j-trump-djt47
franceinfo live, Oct. 24, 08:44 Paris — https://www.franceinfo.fr/faits-divers/terrorisme/attentat-raciste-a-trappes/direct-la-seconde-personne-placee-en-garde-a-vue-dans-l-enquete-sur-l-attentat-terroriste-raciste-dans-les-yvelines-est-la-mere-du-suspect_8251939.html
BFMTV, Oct. 24, 08:50 Paris — https://www.bfmtv.com/police-justice/attaque-terroriste-raciste-a-trappes-et-la-verriere-la-mere-du-suspect-placee-en-garde-a-vue_AN-202610240121.html
Breaking alerts post first on X @EPDailyBrief, with more on Instagram and Threads @executiveprotectiondaily.
Need a custom security brief for an event or trip? Request one here.
Open-source reporting only; verify before acting.