Thursday, 22 October 2026

Two killed in attack on Saudi airport as US pulls some diplomats

Two people were killed in an attack on an airport in eastern Saudi Arabia, the authorities said, according to the BBC. DW separately reports that the United States has ordered some diplomats to leave Saudi Arabia amid a Houthi threat. The headlines do not establish who carried out the airport attack, and the two reports should not be treated as one confirmed chain of events. They do show that Gulf aviation and diplomatic sites are being treated as exposed. For organisations with staff, contractors or visitors in the Kingdom, the practical questions are immediate. Confirm where every traveller and assignee is today. Review airport transfer routes and the timing of movements through eastern Saudi Arabia. Check whether your insurer and evacuation provider have changed their conditions for the region. Agree in advance who can order a departure, and what triggers it, so the decision is not made under pressure. Watch embassy travel advisories, since a further drawdown by other governments would be an early signal of how they read the threat.

Our advisory and intelligence team turns regional threat reporting into travel and duty-of-care decisions for staff in the Gulf.

Missiles hit Kyiv after Russia agrees to resume peace talks

Update on yesterday's Witkoff visit: the Kremlin has agreed to a US call to resume peace talks, yet missiles hit Kyiv overnight and Russia and Ukraine traded attacks. Euronews reports seven people killed in Russian strikes, and that Zelenskyy backs freezing the front line as a first step towards a ceasefire. Russia also freed the US teacher Stephen Hubbard during the envoy's visit. The pattern is familiar: diplomacy and strikes run in parallel, and neither side has shown that talks will slow the shelling. For companies with Ukrainian staff, suppliers or logistics, the working assumption should stay that strikes on cities and energy infrastructure continue during negotiations. Keep contact lists and shelter arrangements current, and test your ability to account for staff within an hour. Review exposure to energy and transport disruption in your supply chain. Treat any announced ceasefire as unverified until it holds for several days, and avoid planning travel to Ukraine around a diplomatic date.

Seafarers say they refuse to cross Hormuz but cannot escape

Yesterday's brief covered IRGC mines setting tankers ablaze; today brings the view from the decks. Seafarers told Euronews they refuse to cross the Strait of Hormuz yet cannot escape the danger, which suggests crews as well as owners and insurers are now declining voyages. Separately, NOS carries a quoted report that the United States and Israel are preparing new attacks on Iran. Its headline names no source, so we treat it as unverified. Al Jazeera runs an opinion piece asking whether Russia can broker a new US-Iran deal. Shippers and energy buyers should plan for tighter capacity and longer routings, not a clean reopening. Confirm which cargoes and crews are inside or near the strait, and what your charter terms say about refusal to sail. Check war-risk cover and notice periods. Prepare contingency routings and stock cover now, because a strike would move rates and availability within hours.

Macron to seek ban on some protests, condemns 'seditious acts'

Yesterday's brief covered the debate over who is to blame for the French riots. The new development: Macron condemned 'seditious acts' by the 'ultra-left' and said he will seek to ban some protests, according to the Guardian's live coverage. The BBC reports that he also accused foreign leaders of exploiting the riots. Neither headline says which protests would be covered or when a ban would take effect. For companies with offices, stores, logistics sites or events in France, a ban tends to shift unrest rather than end it. Expect smaller, less predictable gatherings and more confrontation near police lines. Review local notices from prefectures and check that site managers know the current closure triggers. Brief staff on routes to avoid, and confirm that deliveries and shift changes can move off peak protest times. Keep a record of incidents and damage for insurers. Reassess executive travel to French cities as the legal details emerge.

Our guarding teams can reinforce access control and observation at premises exposed to unrest.

OVHcloud GitHub compromise tied to GlassWorm threat actors

Dark Reading reports that a compromise of OVHcloud's GitHub presence has been tied to threat actors known as GlassWorm. The headline gives no detail on what was accessed, and the attribution comes from a single outlet, so treat both as provisional. The case matters because OVHcloud is a European cloud provider, and compromised developer accounts or repositories are a route into customers' build pipelines. Organisations that use OVHcloud tooling, open-source code or scripts from its repositories should check now whether anything was pulled from them recently. Review the commit history and release artefacts you depend on, and pin dependencies to verified versions. Rotate tokens and secrets that have touched affected repositories or CI jobs. Ask your provider in writing what was exposed and when customers will be told. Add GitHub audit-log review to your routine, because supply-chain intrusions are often found first in logs nobody reads.

Our cyber team can review your dependency and repository exposure to a provider-side compromise like this one.

Dutch government pages back online after PHP flaw, no data stolen so far

Yesterday's brief reported websites going offline over a leak. Today NOS says Dutch government pages are back online after the PHP flaw, with no data leaked or stolen so far. NL Times says some important Dutch websites are still offline, while DW reports many German sites back after a security fix. The Record says the PHP team's AI review first sparked alarm in August, but signs surfaced in 2024. Dark Reading calls the 'PHP2Shell' bugs a red alert for the security industry. 'No data stolen so far' describes what has been seen, not proof of what happened. As signs date back to 2024, assume exploitation may predate the fix. Patch every PHP-based system you run, including forgotten microsites and supplier portals. Review web server and application logs back to August for unusual requests or new files. Ask each supplier hosting PHP for you to confirm in writing that they have patched.

Our cyber team can check exposed PHP systems and logs for signs of exploitation before the patch date.

Dutch police take down 30 illegal medicine sites after fake oxycodone kills three

Dutch police have taken down 30 illegal medicine websites after fake oxycodone killed three people, NL Times reports. The headline does not say who ran the sites, how the pills were sold or how the victims obtained them. The case sits at the line between organised crime and corporate risk. Counterfeit pills sold online reach employees as well as the public, and a fatal case at a workplace brings duty-of-care questions, press attention and police inquiries. Organisations should not treat this as a purely medical matter. Check that your employee assistance and occupational health channels give clear, confidential advice about buying medication online. Make sure security and HR agree on how a suspected overdose on company premises is handled, from first response to evidence preservation. Brief reception and facilities teams on recognising and reporting suspected substance incidents. Takedowns of this kind often displace sellers to new domains, so expect the offer to reappear.

Afghan men whose body parts washed ashore on Texel were victims of notorious people smuggler

NL Times reports that the Afghan men whose body parts washed ashore on Texel were victims of a notorious people smuggler. The headline gives no name, route or timeline, so details should be treated as reported rather than established. Beyond the human tragedy, the case shows that the activity of smuggling networks can surface in Dutch coastal communities. For operators of ports, ferries, marinas, offshore sites and coastal hospitality, the practical issue is recognising and reporting unusual activity and finds. Make sure staff know who to call if they discover human remains, abandoned vessels or clothing in suspicious circumstances, and that they do not disturb the scene. Review CCTV coverage and retention at quays, jetties and car parks. Brief night staff on indicators of smuggling activity, such as unexplained vehicles at remote landings. Agree in advance how the company handles media and police requests, so that statements are accurate and respectful.