Bottom Line Up Front
Kraków (Poland): Six people were killed and 15 wounded when a gunman fired from a car around Main Market Square just after 1500 local Saturday; the 24-year-old Polish suspect was shot by police and is in critical condition. Prosecutors opened a terrorism investigation, and police reclosed the square and adjoining streets Sunday for further scene work. Poland is in national mourning Nov. 8–9; Kraków through Nov. 11. [1][2][3]
Saudi Arabia: The Saudi-led coalition says it intercepted two ballistic missiles fired at Riyadh plus cruise missiles and a drone on Sunday. The Energy Ministry says falling shrapnel caused limited damage to a Saudi Aramco administrative building in Riyadh, with no injuries. Houthi claims of hitting King Khalid International Airport are unverified. [4][5]
U.S. posts in the Middle East: A Nov. 7 U.S. security alert warns of an “increased threat of armed attacks by Iranian-supported Houthis and Iranian efforts to target U.S. government officials in the region,” and says Iran-aligned groups may target U.S. businesses worldwide. [6][7]
France: Saturday’s fourth weekend of protests drew 146,000 nationwide (46,000 in Paris) per the Interior Ministry; police used tear gas at Place de la Nation and blocked the banned Yellow Vest gathering at Concorde. Education unions call a new strike Tuesday. [8][9]
For solo operators: In Kraków, keep principals clear of the Old Town core, Grodzka, Stradomska and Dietla until police lift Sunday’s cordons, and expect a heavier police presence nationwide during the mourning period. [2][3] In Riyadh, follow Civil Defense alerts and plan shelter options away from glass. [4][6]
For corporate security teams: Briefing items for leadership:
Lone-actor risk in tourist cores: The Kraków attacker held a firearms license and had no prior record, per police. Review crowded-venue protocols for staff traveling in Europe this week. [1][2]
Gulf exposure: Missile and drone activity over Riyadh continues, and a U.S. alert now names threats to U.S. officials and businesses. Reconfirm evacuation and shelter plans for Saudi-based staff. [4][5][6]
Cyber: South Korea’s financial-sector breaches continue; Mirae Asset Securities is the latest. Expect impersonation calls and texts to follow. [12][13]
Threats to Executives & Public Figures
U.S. officials and businesses (Middle East): The U.S. Mission to Yemen’s Nov. 7 alert, matching wording issued across the region, cites Iranian efforts to target U.S. government officials and warns that Iran-aligned groups “may target other U.S. interests overseas or at locations associated with the United States and Americans throughout the world, including U.S. businesses.” Edit USA counted at least seven U.S. posts carrying the same alert by Nov. 6. [6][7]
EP note: Treat U.S.-branded offices, hotels and events in the region as higher-profile; vary routines and avoid areas with heavy police presence, as the alert advises.
Kraków attacker profile: Police say the suspect had no prior record and held a firearms license. Interior Minister Marcin Kierwiński said he appeared to hold “very radical views” and was “fascinated by far-right ideologies”; officials say that assessment is still being verified. Police found the bodies of his parents and sister at his home in Ostrowiec Świętokrzyski. [1][2][3]
Travel Advisories & Hotspots
Poland, Kraków: Kraków’s city government says six were killed (four women, two men) and 15 injured; a tram on line 1 was also fired on at Plac Wszystkich Świętych, with no injuries. Voivode Krzysztof Klęczar said a 32-year-old British man was among the dead; Reuters, cited by Onet, reports the five injured foreigners are from Austria, Germany, Portugal, Russia and the U.K. [2][3]
Sunday access: Police announced the Main Market Square, adjoining streets and the escape route (Grodzka, Plac Wszystkich Świętych, Stradomska, the Gertrudy junction and Dietla/Stradomska) will be closed for several hours for further examination. St. Mary’s Basilica was to stay closed until about midday. [3]
Reported by Onet: Warsaw has added barriers limiting vehicle access to Krakowskie Przedmieście as a precaution. [3]
Saudi Arabia: Coalition spokesperson Maj. Gen. Turki Al-Maliki reported intercepts of two ballistic missiles aimed at Riyadh and of cruise missiles and a drone over Riyadh and the south on Sunday; Civil Defense alerts for Riyadh, Najran, Buqayq, Al-Ahsa and Dammam were lifted afterward. Arab News counts at least 15 missiles and drones intercepted so far in November. [4][5]
Where sources differ: Arab News says two cruise missiles and a drone were intercepted; The National reports two cruise missiles and does not mention the drone.
Civil Unrest in Business Hubs
France: Interior Ministry figures: 146,000 protesters nationwide, 46,000 in Paris; unions claimed 250,000 and 75,000. About 70,000 police and gendarmes deployed. Police used tear gas at Place de la Nation after projectiles and fireworks were thrown; police allege about 200 violent individuals attacked officers. Tear gas was also used in Lyon. About 100 people at the banned Concorde gathering were surrounded; coordinator Benjamin Ball and spokeswoman Azelma Sigaux were arrested. [8][9]
Reported by CNBC (citing AFP): At least 360 arrests nationwide. [9]
Next: Prime Minister Sébastien Lecornu meets unions and employers Monday; student and teacher groups have called a strike for Tuesday, Nov. 10. Shopfronts in Paris were again boarded on Saturday. [8][9]
Aviation & Transport
Europe hoax bomb threats: Paris prosecutors are investigating the emails behind false bomb threats against dozens of flights over the past week, including possible links to foreign powers. No explosives have been found and no one has been identified. [10][11]
Reported by The Independent (citing the Financial Times): European intelligence services suggest pro-Kremlin activists or hacking groups produced the threats; that attribution is not confirmed. [11]
EP note: An in-flight threat triggers a diversion even when it is likely a hoax. Build slack into connections and keep principals’ ground transport flexible at both ends.
Saudi airports: Houthi spokesman Yahya Saree claimed attacks on King Khalid International Airport; Saudi authorities have not confirmed any airport damage. Confirm flight status with the airline before moving to RUH. [5][7]
FAA (checked 0600 ET): No ground stops or delay programs listed. San Diego (SAN) is closed until 1400 UTC (0900 ET) and Santa Ana (SNA) until 1415 UTC under NOTAMs. LAX, SAN and LAS remain closed to unscheduled transient GA without prior permission. [16]
Cyber & Doxxing Risk to Principals
Mirae Asset Securities (South Korea): Attacks on Nov. 4–5 hit a mobile-web login service and internal groupware, leaking account numbers of about 3,800 customers and names, employee IDs, email addresses and mobile numbers of about 35,000 current and former staff. It is the fourth Mirae Asset Group affiliate hit since Oct. 26. The company warns of calls, texts and emails impersonating it. [12][13]
Reported by CoinDesk — Gnosis Pay breach: The crypto debit card provider detected unauthorized access on Nov. 3 that exposed names, home addresses, card numbers and linked wallet addresses; customer funds were not affected. The company has not said how many users were hit. [14]
Why it matters: Data tying a home address to crypto holdings is a physical-security issue, not just fraud. If a principal used this card, review residential security and expect targeted phishing.
Severe Weather
New York City: Mostly sunny Sunday, high near 62°F, west winds gusting to 29 mph; Monday mostly sunny, high near 59°F. No active NWS alerts for NY, NJ or CT at check time. [15]
South Texas: Flood Watch through Monday morning for Corpus Christi, Laredo, Kingsville and surrounding counties: 2–5 inches of rain common, isolated 7–9 inches possible. WPC keeps a Slight Risk (level 2 of 4) of excessive rainfall. [17][18]
Pacific Northwest / Northern Plains: Rounds of rain, mountain snow and strong coastal winds through Monday night; very gusty downslope winds in northern Montana today. Frost and freeze possible this morning from the Ohio Valley to the Mid-South. [18]
Tropics: NHC (0100 ET): no tropical cyclone formation expected in the Atlantic, Caribbean or Gulf over the next 7 days. [19]
Tradecraft Tip
General guidance, not tailored advice.
After a mass-casualty attack, the first 48 hours are about cordons, not the attacker. Once a suspect is in custody, the main disruption to a principal comes from scene work, reclosures and memorials:
Assume cordons can return the next day. Kraków police reopened parts of the square overnight, then closed it again Sunday morning for daylight forensics.
Map the attacker’s route, not just the scene. Police closed the escape route too.
Expect memorials and vigils to draw crowds and media to the same spot for days; plan alternate walking routes and meeting points.
Watch for copycat threats and disinformation. Poland’s digital ministry says it is seeing a surge of false and unverified claims about the attack.
Coming Up
Mon, Nov. 9: Poland’s national mourning ends; Kraków’s continues through Nov. 11. Lecornu’s wage talks with French unions and employers. Showers in upstate New York and interior New England. [2][3][8][18]
Tue, Nov. 10: Education strike and protests called in France. [8]
Sources
Euronews, “What we know about the Krakow shooting that left six people dead,” Nov. 8, 2026 — https://www.euronews.com/2026/11/08/what-we-know-about-the-krakow-shooting-that-left-six-people-dead
City of Kraków (official), “Strzały w centrum Krakowa. Są zabici i ranni,” Nov. 8, 2026 — https://krakow.pl/aktualnosci/345151,29,komunikat,strzelanina_w_centrum_krakowa__sa_zabici_i_ranni.html
Onet, live coverage, “Rusza śledztwo po strzelaninie w Krakowie,” updated Nov. 8, 2026, 1154 local — https://wiadomosci.onet.pl/krakow/strzelanina-w-krakowie-najnowsze-informacje-relacja/p16e8gh
Arab News (with Reuters), “Aramco building in Riyadh targeted, Saudi energy ministry says,” Nov. 8, 2026 — https://www.arabnews.com/saudi-arabia/saudi-defenses-intercept-houthi-missiles-targeting-riyadh-southern-regions-3010424
The National, “Aramco building in Riyadh damaged in attempted attack, ministry says,” Nov. 8, 2026 — https://www.thenationalnews.com/news/gulf/2026/11/08/saudi-led-coalition-intercepts-two-houthi-missiles-fired-towards-riyadh/
U.S. Mission to Yemen, “Security Alert: Yemen – November 7, 2026” — https://ye.usembassy.gov/security-alert-yemen-november-7-2026/
Edit USA, “U.S. warns Americans in the Middle East of higher attack threat from Houthis and Iran,” Nov. 6, 2026 — https://www.editusa.com/news/us-embassy-security-alert-middle-east-houthis-iran-threat
France 24 (AFP), “Sporadic clashes between police and protesters as renewed demonstrations sweep France,” updated Nov. 7, 2026 — https://www.france24.com/en/france/20261107-sporadic-clashes-between-police-and-protesters-as-renewed-demonstrations-sweep-france
CNBC, “In pictures: France protests draw 146,000 as clashes erupt for fourth straight weekend,” Nov. 8, 2026 — https://www.cnbc.com/2026/11/08/france-protests-clashes-arrests.html
France 24 (AFP), “France investigating if bogus bomb threats against airlines linked to ‘foreign powers’,” Nov. 7, 2026 — https://www.france24.com/en/france/20261107-france-investigating-if-bogus-bomb-threats-against-airlines-linked-to-foreign-powers
The Independent, “Russia likely behind bomb hoaxes that grounded flights, say European intelligence,” Nov. 7, 2026 — https://www.independent.co.uk/news/world/europe/russia-bomb-threats-europe-flights-b3080924.html
Aju Press, “Hack at Mirae Asset Securities exposes data of 39,000,” Nov. 7, 2026 — https://www.ajupress.com/view/20261107093920797
SBS News, “Korea’s Largest Brokerage Hit by Cyber Attack... Data of Some 39,000 Leaked,” Nov. 7, 2026 — https://news.sbs.co.kr/english/article.do?news_id=N1008835438
CoinDesk, “Gnosis Pay breach exposes card numbers, home addresses and linked crypto wallets,” Nov. 7, 2026 — https://www.coindesk.com/business/2026/11/07/gnosis-pay-breach-exposes-card-numbers-home-addresses-and-linked-crypto-wallets
National Weather Service New York (OKX), NYC forecast and active alerts for NY, NJ, CT, checked Nov. 8 — https://api.weather.gov/gridpoints/OKX/33,42/forecast
FAA National Airspace System Status, update Nov. 8, 1100 UTC — https://nasstatus.faa.gov/api/airport-status-information
National Weather Service Corpus Christi, Flood Watch, issued 0034 CST Nov. 8, 2026 — https://forecast.weather.gov/wwamap/wwatxtget.php?cwa=usa&wwa=Flood+Watch
NWS Weather Prediction Center, Short Range Forecast Discussion, 0300 EST Nov. 8, 2026 — https://tgftp.nws.noaa.gov/data/raw/fx/fxus01.kwbc.pmd.spd.txt
National Hurricane Center, Atlantic Tropical Weather Outlook, 0100 EST Nov. 8, 2026 — https://www.nhc.noaa.gov/text/MIATWOAT.shtml
Breaking alerts post first on X @EPDailyBrief, with more on Instagram and Threads @executiveprotectiondaily.
Need a custom security brief for an event or trip? Request one here.
Open-source reporting only; verify before acting.