Bottom Line Up Front
Saudi Arabia: the U.S. has ordered non-emergency staff and families to leave. The State Department issued an ordered departure Wednesday, citing Houthi attacks on “civilian airports and other critical infrastructure,” and warned the hostilities “have the potential to escalate rapidly.” [3] U.S. government staff now need Chief of Mission approval to use any Saudi airport. [4]
Dammam airport attack: the toll has risen to two dead and eight injured. Saudi Arabia’s civil aviation authority (GACA) says King Fahd International Airport has resumed operations and air traffic is back to normal. It has not said what kind of attack it was, and the Houthis made no immediate comment. Reported by BBC News and Arab News. [1][2] Emirates and flydubai cancelled Thursday’s Dubai–Dammam flights. Reported by Gulf News. [6]
France: Police have banned protests Thursday around the Élysée, parliament, the Louvre and the Champs-Élysées, and banned a march in Lyon. The Paris route for Saturday is still not approved. Italy is sending 500 paratroopers to Milan. Reported by RFI, BFMTV and ANSA. [11][12][13]
Also today: Police recovered a gun in the GWB killing and are testing it. [7] Rep. Nancy Pelosi’s office is the latest to receive a suspicious letter. [10] CISA says attackers are actively exploiting the Plex Media Server flaws known as “Plex2Shell.” [17][18]
For solo operators: If your principal is in Paris, Lyon or Milan this weekend, plan around the protest-ban zones and keep routes clear of Bastille, République and Opéra on Saturday afternoon. [11][12] If your principal runs a Plex server at home, update it now. Plex2Shell gives an attacker admin access to the server. [18]
For corporate security teams: Briefing items for leadership: (1) the U.S. ordered departure from Saudi Arabia is a trigger to review your own staffing, dependents and overland exit plans for the kingdom, [3][4] (2) expect Saturday protests across France and possible disorder near retail districts, [11][12] (3) ConnectWise Cloud Backup is in a phased restoration that will take “several days,” and Microsoft 365 tenants still need a review. [16]
Threats to Executives & Public Figures
George Washington Bridge (follow-up): Police say Victor Romero, 62, is charged with murder in Tuesday’s road rage killing of Koran Irvine, 46. Investigators have recovered a gun and are testing whether it was used in the shooting. Romero’s vehicle is in custody, and the NYPD was at his Haverstraw home waiting to execute a search warrant, police sources said. Bridge technology and license plate readers helped the investigation. Romero joined the NYPD in 1994 and retired as a narcotics detective on disability after being shot by robbers at his family’s Brooklyn coin laundry. In the reporting we reviewed, no arraignment outcome had been made public. Reported by CBS New York. [7]
Analyst note: Bridge technology and license plate readers helped police reach a suspect within a day. If your principal is ever involved in an incident on a monitored crossing, preserve your own dashcam footage and log the time and lane right away.
Australia (Haines case, follow-up): Helen Haines remains in critical condition three days after the attack, and her staff hope to reopen her Wangaratta office next week. Police say the motive is still unknown. Reported by ABC News (Australia). [9] Victorian Premier Ben Carroll said extra security resources will be in place for the Nov. 28 state election. The Australian Federal Police has warned that online radicalization can now take hours rather than months. In the Perth case, a man faced court Thursday over the alleged nunchuck threats at state minister Hannah Beazley’s office. AAP gives his age as 53. We reported 56 yesterday, citing ABC. Reported by AAP. [8]
Suspicious mailings (U.S.), follow-up: On Wednesday, Rep. Nancy Pelosi’s San Francisco office received a suspicious letter that a spokesperson said was “consistent with mailings reported by other congressional offices.” Everyone in the office was safe. The FBI, U.S. Capitol Police and U.S. Postal Inspection Service are investigating. The Guardian says more than 100 letters were reportedly thought to be in the mail system. Reported by The Guardian. [10]
Travel Advisories & Hotspots
Saudi Arabia (U.S. Embassy, Oct. 21): The embassy warns of possible attacks on airports, airspace closures and flight cancellations. It urges “extreme caution” at Saudi airports. [4]
Airports: The alert lists Riyadh’s King Khalid International as suspended and Jeddah and Dammam as operating with delays and cancellations. Gulf News separately reports that Riyadh has resumed a limited number of domestic flights that need prior approval. [4][6]
Overland routes: All land borders are open, including the King Fahd Causeway to Bahrain. So are the airports in Bahrain, Amman, Muscat, Doha, Abu Dhabi, Dubai and Sharjah. The embassy lists rail and bus operators as alternatives to flying. [4]
Photography: Do not film or share interceptions or impact sites. U.S. citizens have been detained for doing so. [4]
Advisory level: The State Department’s Travel Advisory is still Level 3 (Reconsider Travel), last issued Oct. 12. When we checked, it did not yet mention the ordered departure. [5]
Eastern Province: Separately from the airport attack, the Saudi energy ministry says debris from a drone intercepted over Aramco’s Shaybah oil field killed two people and injured two others. Operations were not affected. The Saudi-led coalition said four more drones were shot down over the Eastern Province. Reported by Arab News. [2] Saudi authorities say at least 21 people have been killed in Houthi attacks on Saudi airports since the start of October. Reported by BBC News. [1]
Civil Unrest in Business Hubs
France: Police banned protests in Paris from 08:00 to 20:00 Thursday around the Élysée, both houses of parliament, the Louvre and the Champs-Élysées. Rallies are also banned at Bastille, République and Châtelet-Les Halles. A student march in Lyon was banned too. Justice Minister Gérald Darmanin said Wednesday that some 2,500 people have been taken into custody, 174 jailed and 917 formally prosecuted. President Macron meets intelligence officials Thursday about security for the coming days. Reported by RFI. [11]
Paris, Saturday, Oct. 24: Two routes have been filed with police:
Yellow Vests and Interfac: from Place de la Bastille to Place de l’Opéra, gathering from 12:00, departing 14:30 and ending at 18:00.
CGT union: from Bastille to Nation.
Status: An organizer said the prefecture rejected the Opéra route and offered Bastille–Nation instead. A meeting on the route was set for Thursday morning. About 340 actions are planned across France, and organizers urged shopkeepers to “lower the shutters.” Reported by BFMTV. [12]
Milan, Italy: About 500 Folgore Brigade paratroopers will deploy in the coming days, through year-end, following last weekend’s youth riots. They will work under the “Safe Streets” program and will not have judicial police powers, after President Sergio Mattarella objected. Their tasks may range from patrols to static guard duty. Reported by ANSA. [13]
Tirana, Albania: On the tenth day of protests, police set up a metal-fence security perimeter around parliament as students, joined by the university workers’ union, rallied outside. PM Edi Rama said hospital figures show 2.5 times as many police officers injured as protesters and bystanders combined. Reported by the Albanian Telegraphic Agency (state news agency). [14][15]
Aviation & Transport
Gulf–Saudi flights: Reported by Gulf News; reconfirm with carriers. [6]
Emirates: Thursday’s Dubai flights to Riyadh, Jeddah and Dammam are cancelled. Only Medina is operating.
flydubai: Thursday’s Dubai flights to Riyadh, Dammam and Abha are cancelled.
Etihad: Abu Dhabi–Dammam and Abu Dhabi–Riyadh are cancelled through Oct. 24, along with some Jeddah flights.
Through Oct. 31: KLM and SalamAir have cancelled Riyadh and Dammam.
Lufthansa Group: Dammam is suspended through Nov. 30 and Riyadh through Nov. 18.
Dammam (DMM): GACA says operations have resumed and traffic is back to normal. Damage assessment and safety checks continue. Reported by Arab News. [2]
Outer Banks, N.C.: NCDOT’s 24-hour emergency ferry between Stumpy Point and Rodanthe starts Thursday. It runs first come, first served, and long waits are expected. Visitors still cannot enter Hatteras Island under the state of emergency. Reported by WITN. [19]
Taiwan: Typhoon Champi has delayed some flights, including Etihad’s Abu Dhabi–Taipei service. Reported by Gulf News. [6] See Severe Weather. [27]
Cyber & Doxxing Risk to Principals
ConnectWise Cloud Backup (update, 00:45 UTC Oct. 22 / 20:45 ET Oct. 21): Phased restoration is underway and is expected to take “several days.” Keep affected connections disabled until ConnectWise issues instructions for your service. Existing backup archives show no sign of compromise, but each Microsoft 365 tenant still needs a review for unauthorized changes or persistent access. ConnectWise will now post updates twice a day. [16]
Plex Media Server (”Plex2Shell”): CISA has added four chained Plex flaws to its Known Exploited Vulnerabilities catalog. [17] Together the chain lets an attacker take the owner’s admin token and run code. Versions before 1.43.3.10861 are affected, and exploitation has been reported since Oct. 17. Reported by BleepingComputer. [18]
Action: Home media servers often sit on the same network as a principal’s cameras, NAS and family devices. Update Plex, or take it off the internet until it is updated.
Disney (unverified claim): A new ransomware group calling itself WhiteArmour has posted what it says is a Disney staff directory. Cybernews reviewed a sample of about 2,800 records with names, work emails and internal IDs, many tied to ABC News and ESPN. Disney had not commented when we checked. Reported by Cybernews. [20]
Action: Staff directories fuel phishing that impersonates colleagues. Warn executive assistants about messages that use real internal names.
Severe Weather
Subtropical Storm Josephine (NHC, 05:00 ET): The storm is about 195 miles south-southeast of Nantucket, with 65 mph winds, moving northeast at 13 mph away from the U.S. NHC expects it to become a powerful extratropical cyclone with hurricane-force winds by early Friday. Gale-force gusts are possible along parts of the Northeast coast today. Minor to locally moderate coastal flooding will continue along the Mid-Atlantic coast at high tides through the rest of the week. Large swells are causing life-threatening surf and rip currents along much of the East Coast. No coastal watches or warnings are in effect. [21]
New York and New Jersey (NWS): NYC will be sunny today with a high near 65 and north winds of 13–16 mph. [26] A Coastal Flood Statement covers Southern Nassau and Southwest Suffolk until 11:00. [23] A Coastal Flood Advisory covers Ocean County, N.J., and the Delaware beaches until 23:00. [24]
North Carolina Outer Banks (NWS): A Coastal Flood Warning covers Hatteras Island until 20:00, with 2–4 feet of inundation possible and breakers of 8–12 feet. The Northern Outer Banks have a Coastal Flood Advisory and High Surf Advisory, also until 20:00. [25] See Aviation & Transport for ferry access. [19]
Tropical Storm Vance, E. Pacific (NHC, 05:00 ET): The storm is 510 miles south-southwest of Acapulco with 50 mph winds. NHC expects rapid strengthening into a major hurricane by Saturday. Swells will reach southern and southwestern Mexico this weekend. No coastal watches are in effect. [22]
Typhoon Rosal (Champi), W. Pacific: As of 17:00 Philippine time (05:00 ET), PAGASA puts the typhoon 350 km east of Itbayat, Batanes, with 165 km/h winds, gusts to 205 km/h, moving northwest. Signal No. 2 is up for Batanes and the northeastern Babuyan Islands. PAGASA says Signal No. 3 may be raised for Batanes. [28] Taiwan’s weather agency has issued a land warning and expects Champi to pass close on Friday, bringing heavy rain and strong winds through Saturday. Reported by Focus Taiwan (CNA). [27]
Tradecraft Tip (general guidance, not tailored advice)
When the airport is the target, plan the ground exit first. In Saudi Arabia, the airport itself has become the hazard. For any principal in a region where airports are being targeted, keep a ground route out of the country current: the nearest open land crossing, a car and driver who can be ready on short notice, and a list of open airports in neighboring countries. Confirm flights directly with the airline before leaving the hotel, not at the terminal. If something is incoming while you are at an airport or hotel, move away from glass and wait for the all-clear. Never photograph impact sites or interceptions, where that can get you detained. Review this plan every time the threat picture changes, not only when you book the trip.
Coming Up
Thursday, Oct. 22: The President holds a rally at Sioux Gateway Airport in Sioux City, Iowa, Thursday evening. Friday, Oct. 23: a rally at Alico Arena in Fort Myers, Fla., at 14:00 ET. Check FAA TFRs if your principal flies near either one. Reported by Roll Call Factba.se. [29]
Friday, Oct. 23: Typhoon Champi is forecast to pass closest to Taiwan. [27]
Saturday, Oct. 24: Paris marches are expected from Place de la Bastille from 12:00. The route was not confirmed as of Thursday morning. There are about 340 actions nationwide. [12]
Sources
BBC News, Oct. 22 — https://www.bbc.com/news/articles/cqwy71ww156ro
Arab News, updated Oct. 22 — https://www.arabnews.com/saudi-arabia/dammams-king-fahd-airport-resumes-normal-operations-3007672
BBC News, Oct. 21 — https://www.bbc.com/news/articles/c6x2vpk93770o
U.S. Embassy & Consulates in Saudi Arabia, Security Alert Oct. 21 — https://sa.usembassy.gov/security-alert-u-s-mission-to-saudi-arabia-october-21-2026/
U.S. Department of State, Saudi Arabia Travel Advisory (Level 3, issued Oct. 12) — https://travel.state.gov/content/travel/en/traveladvisories/traveladvisories/saudi-arabia-travel-advisory.html
Gulf News, UAE flight status, updated Oct. 22 — https://gulfnews.com/business/aviation/uae-flight-status-today-cancellations-delays-and-updates-after-saudi-airport-attack-1.500719321
CBS New York, updated Oct. 21, 23:50 ET — https://www.cbsnews.com/newyork/news/george-washington-bridge-shooting/
AAP, Oct. 22 — https://aapnews.aap.com.au/news/mp-attack-spurs-unprecedented-election-security-talks
ABC News (Australia), Oct. 22 — https://www.abc.net.au/news/2026-10-22/helen-haines-three-days-since-attack/107297946
The Guardian, Oct. 21 — https://www.theguardian.com/us-news/2026/oct/21/nancy-pelosi-office-letter-white-powder
RFI, Oct. 22 — https://www.rfi.fr/en/france/20261022-police-ban-protests-in-french-cities-ahead-of-fresh-saturday-demonstrations
BFMTV, Oct. 22 (French) — https://www.bfmtv.com/societe/manifestations/manifestations-du-24-octobre-ce-que-l-on-sait-des-parcours-proposes-pour-la-journee-de-samedi-a-paris_AV-202610220277.html
Albanian Telegraphic Agency, Oct. 22 (Albanian) — https://ata.gov.al/2026/10/22/proteste-jashte-kuvendit-policia-rrethon-parlamentin-me-gardh-metalik/
Albanian Telegraphic Agency, Oct. 21 — https://en.ata.gov.al/2026/10/21/pm-rama-injured-police-officers-outnumber-injured-protesters-and-bystanders-by-2-5-to-one/
ConnectWise Trust Center, Cloud Backup advisory (updated Oct. 22, 00:45 UTC) — https://www.connectwise.com/company/trust/advisories
CISA, KEV catalog additions, Oct. 20 — https://www.cisa.gov/news-events/alerts/2026/10/20/cisa-adds-six-known-exploited-vulnerabilities-catalog
BleepingComputer, Oct. 21 — https://www.bleepingcomputer.com/news/security/cisa-hackers-chain-plex-flaws-in-plex2shell-attacks-to-breach-servers/
WITN, Oct. 21 — https://www.witn.com/2026/10/21/ncdot-emergency-ferry-service-start-thursday/
Cybernews, Oct. 21 — https://cybernews.com/security/disney-data-breach-claim/
NHC, Subtropical Storm Josephine Public Advisory #3 (09:00 UTC, Oct. 22) — https://www.nhc.noaa.gov/text/MIATCPAT5.shtml
NHC, Tropical Storm Vance Public Advisory #4 (09:00 UTC, Oct. 22) — https://www.nhc.noaa.gov/text/MIATCPEP2.shtml
NWS active alerts, New York — https://api.weather.gov/alerts/active?area=NY
NWS active alerts, New Jersey — https://api.weather.gov/alerts/active?area=NJ
NWS active alerts, North Carolina — https://api.weather.gov/alerts/active?area=NC
NWS forecast, New York City — https://api.weather.gov/gridpoints/OKX/33,42/forecast
Focus Taiwan (CNA), Oct. 22 — https://focustaiwan.tw/society/202610220006
PAGASA, Tropical Cyclone Bulletin #10, Typhoon Rosal (17:00 PHT, Oct. 22) — https://pubfiles.pagasa.dost.gov.ph/tamss/weather/bulletin_rosal.pdf
Roll Call Factba.se, President’s public schedule — https://rollcall.com/factbase/trump/calendar/
Breaking alerts post first on X @EPDailyBrief, with more on Instagram and Threads @executiveprotectiondaily.
Need a custom security brief for an event or trip? Request one here.
Open-source reporting only; verify before acting.