Daily intelligence briefing: 18 October 2026

Sunday opens with the Riyadh closure past its stated end and nothing announced to replace it, the outcome we planned for on Friday, and with the carriers cancelled well beyond the date. The Revolutionary Guard says two laden tankers caught fire after striking mines in the Strait of Hormuz while Washington insists the strait is clear of mines and that projectiles are doing the damage, UKMTO has raised its weekly count to at least twelve ships attacked, and Egypt has publicly offered Saudi Arabia defensive support. France’s day of action passed with some five hundred and fifty thousand on the street and the licensed Paris route broadly holding, leaving the capital’s Sunday to residual closures rather than fresh disruption. London is quiet, and the weekend’s most actionable development is digital: ransomware has moved into the systems that run buildings.

United Kingdom and London

The national terrorism threat level remains at SEVERE and the weekend has produced no new public development on the files we are tracking. The Fairford investigation stands where Friday left it, with the seven men on police bail, none charged, and the Central Criminal Court hearing on 23 October the next procedural marker. The Foxtrot Network guidance that Friday’s Old Bailey sentencing placed on judicial record does not move: protective screening for principals with visible connections to Jewish community institutions remains a live matter, and American affiliated addresses in London should continue to assume sustained elevated attention. A quiet day is the moment to hold the discipline rather than relax it. London’s Sunday is expected wet, with the rain signalled in Saturday’s forecast moving through during the day and temperatures in the low teens falling away overnight.

Travel corridors

The Riyadh closure notice expired at nine on Saturday evening universal time, midnight in the kingdom, and nothing has replaced it in public: the General Authority of Civil Aviation has announced neither a reopening nor a formal extension, and as we observed on Friday the silence is the answer. The airlines have already decided. Air India and Air India Express remain cancelled to 20 October, Akasa Air to 21 October for Jeddah and 24 October for Riyadh, IndiGo to 24 October inclusive across Riyadh, Jeddah, Dammam and Madinah, KLM to the end of the month, Philippine Airlines to the end of November, and Cathay Pacific has pushed the resumption of its Riyadh and Dubai services to the end of January. The American embassy’s alert of 16 October speaks only through 17 October, and Australia’s advice remains do not travel. The exchange itself continued, with the coalition reporting four drones intercepted and destroyed over Riyadh, the Eastern Province and the south on Saturday and counting twenty Houthi attacks on the capital’s airport since the start of the month. The notable movement is diplomatic: President Sisi declared that Egypt will take all measures necessary to defend Saudi Arabia, strictly defensive in nature and subject to parliamentary approval, a public commitment of Arab depth to the kingdom’s air defence that follows Friday’s Security Council condemnation. Our judgement is unchanged: Saudi aviation is closed to planning, the kingdom’s south is out of bounds, and we treat the airport as closed until a reopening is formally announced and the carriers follow. The Dubai corridor stays deferred, a judgement Cathay Pacific’s January date now echoes.

At sea the dispute has moved to the nature of the weapon. The Revolutionary Guard said on Saturday that two tankers, each laden with some two million barrels, caught fire after striking naval mines on routes Tehran had not authorised, both reportedly sailing dark, and its naval commander has warned that any vessel deactivating its navigation systems will be treated as hostile. Central Command maintains the strait has been cleared of mines and that vessels are being struck by projectiles, as it says the container ship GFS Pride was before sinking under tow on Thursday. UKMTO has meanwhile raised its weekly count to at least twelve ships attacked in the seven days to Friday, of which one sank and two were disabled, repeated that most attacks go unreported, and logged a new method on Saturday: a rocket propelled grenade fired from a small boat against a tanker seventy eight nautical miles northeast of Jubail. The flows tell the practical story, around eleven and a half million barrels a day through the strait in the week to Monday, roughly two thirds of the pre war baseline and swinging violently day to day, and Brent touched a hundred and ten dollars on Friday for the first time since May. Washington says it and its partners, not Iran, control the strait, having moved four hundred ships and a hundred million barrels in a week; Tehran’s acting defence minister answered that Iranian missiles will decide the war’s future. For our purposes the attribution matters less than the arithmetic, because the water is dangerous whichever account one accepts. In France the day of action passed and the balance sheet is tolerable: the interior ministry counted some five hundred and fifty thousand demonstrators nationwide with a hundred and ten thousand in Paris, dozens were detained in the capital, the licensed route broadly held, and the sharpest scenes were in Marseille, where protesters forced the town hall door. Paris’s Sunday is residual rather than acute, with a small number of Metro stations awaiting police authorisation to reopen, the Louvre warning of a late start and requiring reservations until 1 November, and both airports operating normally. The air traffic control suspension held through the weekend’s flying, though the promised decree has still not been published and the notice runs only to Wednesday, so the suspension remains conditional on performance. London, Monaco and Geneva are quiet, Zurich connections continue to route around the Gulf, and New York is routine, with federal funding carried to 11 December and the midterms on 3 November now just over a fortnight out. The confederations’ next fixed point remains the interprofessional strike on 5 November.

Health and privacy exposure

The health file still needs one line only: the American entry restrictions on travellers who have been in the Democratic Republic of the Congo, Uganda or South Sudan within the previous twenty one days run to early November under the renewed order, the comparable Canadian measures continue to apply, and travel history should be checked before any North American movement.

The digital file turns this weekend from the network perimeter to the building itself. Reporting published on Saturday collects a pattern we regard as directly relevant to our clients: ransomware operators are increasingly attacking building automation systems, thousands of remotely managed refrigeration systems in the French grocery sector have been hacked with temperatures raised and fires started, a Canadian hospital lost door access and climate monitoring to ransomware in August, and in one documented case attackers pivoted from a financial institution’s building management system into its corporate network and left backdoors in the building controls for persistent access. Researchers put the share of building systems speaking insecure protocols at around ninety per cent. A principal’s residence and family office run on exactly these systems, access control, cameras, climate and fire panels, commonly installed by integrators and then forgotten: they should be inventoried, separated from the office network and brought under the same patching discipline as the computers. Two smaller items warrant attention. Fraudulent advertisements impersonating the main artificial intelligence platforms are spoofing corporate login pages to harvest passwords and the codes behind two factor authentication, a reminder that staff should reach such services by bookmark rather than by search, and a study of connected vehicles found nineteen of twenty one models contacting outside companies, with a third of companion applications sharing identifiers with advertising and tracking firms, which for a principal is a location privacy exposure parked on the driveway. The Cisco perimeter disclosures of the past week, including an authentication bypass in its wide area network management and an exploited email gateway flaw, extend Friday’s instruction: this month’s updates should be taken promptly rather than on the usual cycle.