GLOBAL WATCH
FLASHCyber: Binance says the $6.3 billion theft ran through several entry points beyond a compromised employee laptop, has set aside $6.34 billion to cove…FLASHShipping: UKMTO counted more than 30 attacks on vessels around Hormuz in October, the most of any month since the war began, as the IRGC claimed four…FLASHDiplomacy: Trump said the Iran war is “going to get wrapped up soon” as Qatari mediators returned to Tehran with edits to a draft deal; a senior Iran…FLASHIndo-Pacific: Rubio, Cho Hyun and Toshimitsu Motegi reaffirmed North Korea’s complete denuclearization in Atlanta, signed a Trilateral Arctic Pacific…FLASHAllies: Seoul says it is weighing extending its Cheonghae naval unit’s operating area toward Oman and adding patrol aircraft, while ruling out any ro…Brent $113.43 ▲+2.37%WTI $104.12 ▲+2.08%Gold $3,898.90 ▼-3.29%Silver $49.28 ▼-5.93%Dow 51,770.31 ▼-1.09%S&P 500 7,580.07 ▼-1.82%Nasdaq 25,437.00 ▼-2.86%U.S. 10Y yield 4.929% ▼-6bp
ET --:--KST --:--
HELIOS GLOBAL WATCHNORTH AMERICA DESK · OSINT DESK
Friday, Oct 23 · Evening Edition
Night pass from orbit · ISS time-lapse · NASA Goddard
A new edition has been published — Saturday, Oct 31 · Morning EditionRead it →
FLASHEnergy & shipping: Reuters said October has seen 28 confirmed ship attacks in and around the Strait of Hormuz, the most on record, with 11 supertankers damaged this month alone; the UAE closed beaches at Umm Al Quwain after oil from the tanker Gem No.2 washed ashore, and Brent rose to its highest since late April (Reuters, UPI).6
  1. Energy & shipping: Reuters said October has seen 28 confirmed ship attacks in and around the Strait of Hormuz, the most on record, with 11 supertankers damaged this month alone; the UAE closed beaches at Umm Al Quwain after oil from the tanker Gem No.2 washed ashore, and Brent rose to its highest since late April (Reuters, UPI).
  2. U.S.-Iran: Ambassador Tom Barrack said 'Could there be a strike this weekend? Absolutely,' adding that the outcome 'won't be regime change,' but President Trump told reporters, 'If that's the case, I don't know anything about it' (AFP, Times of Israel, Mediaite).
  3. Cyber: CISA added CVE-2026-114625 in Arista VeloCloud Orchestrator and CVE-2026-110447 in Collabora Online's built-in CODE server to its KEV catalog on Oct 23; attackers had been planting web shells on Nextcloud servers through the Collabora flaw since mid-September (CISA, BleepingComputer).
  4. Ukraine: The White House said Melania Trump brokered a local ceasefire in Russian-occupied Oleshky for demining, aid and civilian evacuation, and Russia's chief of general staff said forces will cease fire on the Kherson axis; the White House gives an Oct 29 start, while Ukraine's ombudsman says Tuesday, Oct 27 (AP, White House).
  5. Markets: About three of every four S&P 500 stocks fell as oil climbed and AI-cost worries lingered, leaving the Dow at 52,215.16 (-1.23%); 94 of 100 economists in a Reuters poll expect the Fed to hold next week, and all 100 expect a December hike (AP, Reuters).
  6. Korea: South Korea's Defense Ministry formally proposed military talks with North Korea to confirm where the land border lies, restore military hotlines and prevent accidental clashes; Pyongyang never answered a similar offer last November (Korea Herald, Korea JoongAng Daily).
HToday's assessmentTHREAT HIGH
HIGH
LOWGUARDEDHIGHSEVERE

Ship attacks around the Strait of Hormuz hit a record in October and oil from a stricken tanker washes onto UAE beaches as a U.S. envoy says a strike on Iran 'absolutely' could come this weekend; Brent climbs to its highest since late April, per Reuters, and the Dow falls 1.23%

Reuters said 28 confirmed attacks on ships in and around the Strait of Hormuz made October the worst month on record, and the UAE closed beaches north of Dubai after oil from the Gem No.2, a tanker hit by a projectile on Oct 9, washed ashore at Umm Al Quwain. U.S. Ambassador to Turkey Tom Barrack said 'Could there be a strike this weekend? Absolutely,' but President Trump said, 'If that's the case, I don't know anything about it'; as of collection, Brent is at $111.66 (+2.76%), WTI at $103.44 (+3.99%) and the Dow at 52,215.16 (-1.23%). CISA added an Arista VeloCloud Orchestrator flaw and a Collabora Online flaw that attackers have used to plant web shells on Nextcloud servers to its Known Exploited Vulnerabilities catalog, and PwC confirmed an incident at a vendor hosting employee training records. The White House said first lady Melania Trump brokered a local humanitarian ceasefire in Russian-occupied Oleshky, and Seoul formally proposed military talks with Pyongyang to settle where the border lies.

The threat level is set from security news and market reaction only. The Pizza Index is not used.
  • Security newsElevatedA record 28 ship attacks around Hormuz in October; oil from a stricken tanker reaching UAE beaches; a U.S. envoy saying an Iran strike could come this weekend and the president saying he knows nothing about it; seven killed in a church attack in Jordan; a local Russia-Ukraine truce in Oleshky; exploited VeloCloud and Collabora flaws added to CISA's KEV catalog
  • Market reactionOil surges, stocks slip, metals softBrent $111.66 (+2.76%) · WTI $103.44 (+3.99%) · Gold $4,010.00 (-1.24%) · Silver $53.96 (-1.90%) · Dow 52,215.16 (-1.23%) · S&P 500 7,623.68 (-0.52%) · Nasdaq 25,955.34 (-0.21%) · U.S. 10Y yield 4.988% (+4bp) · VIX 19.45 (+2.21%) · USD/KRW 1,323.66 (-0.13%) · Bitcoin $81,330 (+0.02%)
GGeopolitics & SecurityTop 3B1
GEO-03Russia Ukraine

Russia and Ukraine agree to a local humanitarian ceasefire in occupied Oleshky that the White House credits to Melania Trump; demining, aid and evacuations to proceed in phases

The White House said on Oct 23 that first lady Melania Trump, acting as 'Exclusive Intermediary,' worked directly with Russian and Ukrainian leadership to secure a temporary halt to military action in Oleshky, a Russian-occupied city in the Kherson region, to allow aid deliveries, demining and the evacuation of civilians through a designated safe passage, with residents able to choose whether to go to Russia or Ukraine. The White House estimates 1,700 to 2,000 residents remain, including about 50 children, out of a prewar population of about 24,000 (White House, Euronews). Ukrainian ombudsman Dmytro Lubinets told AP the ceasefire begins Tuesday at 4 a.m. Moscow time, will last several days and will proceed in three phases — demining, aid delivery and evacuation — calling the operation 'extremely challenging to implement'; it covers the Kherson region and neighboring areas needed for the operation. Gen. Valery Gerasimov said Russian forces 'will cease fire on the Kherson axis,' and Russia's ombudswoman confirmed the deal and pledged safe passage for those who want to leave (PBS NewsHour/AP). Kremlin spokesman Dmitry Peskov credited the first lady's 'significant contribution,' and Ukrainian lawmaker David Arakhamia thanked her and Pope Leo XIV (Philadelphia Inquirer/The New York Times). The White House, Euronews and The New York Times put the start on Thursday, Oct 29, which conflicts with the Ukrainian account.

Analytic judgmentRussia's top general and both sides' human rights officials have confirmed the deal and Washington brokered it directly, but evacuations come last in a phased operation that starts with demining and the two sides do not even agree on a start date, so it is likely that civilians are evacuated from Oleshky through the agreed passage by Nov 15, 2026.
Likelihood Likely (55–80%)Confidence Moderate
Scored callDue 2026-11-15 · Resolves yes if, between Oct 24 00:00 and Nov 15 23:59 Kyiv time, the White House, Ukraine's parliamentary human rights commissioner or presidential office, or the Kremlin or Russia's human rights commissioner says that at least one group of civilians has left Oleshky through the safe passage agreed under the ceasefire, or Reuters or AP report this citing officials from either side. Aid deliveries or demining alone, announcements of planned or postponed evacuations, and individual departures outside the agreed passage do not count. Sources: White House, Ukrainian ombudsman and Kremlin statements, Reuters and AP reporting. Scorecard →
  • Indicators to watch · Which start date holds (Oct 27 or Oct 29), demining and the first aid convoys, the number and destination of evacuees, reports of shelling or drone strikes on the Kherson axis, whether Ukraine's Starlink speed cap is lifted
MMarkets & FinanceMKT2 items
MKT · EconomySecurities Decembe

C2TD Securities: a December hike is 'all but locked in,' and one bad inflation print could put 50bp in play

TD Securities said an October hold raises the odds of a December hike and the risk that officials fall behind the curve, warning that 'one notably bad inflation report and/or a collection of strong labor market data' could get markets pricing a 50bp increase (FXStreet).

  • B2Energy and chip names buck a broad selloffThe AP said Chevron, ConocoPhillips, Micron and Intel gained while American Express, Caterpillar, JPMorgan Chase and Citigroup fell, and noted that the war with Iran has cut global oil supply and pushed up costs for gasoline, food and clothing (BNN Bloomberg/AP).
SSupply Chain & LogisticsSCM4 items
SCM · Supply ChainUAE oil

B1UAE oil slick measured at 160 to 190 square kilometers; residents report fumes, officials say no health risk

Reuters said satellite images from Oct 19 and 21 showed a slick of about 160 sq km off Umm Al Quwain, while The New Arab said it stretched 40 km and covered 190 sq km within 6 km of shore by Oct 21. Fishermen were told to avoid the area, Reuters noted the UAE relies on desalination for drinking water, and authorities said odors reported in Umm Al Quwain, Sharjah and Ajman pose no health risk (bdnews24/Reuters, The New Arab).

  • B2Aramco evacuated its Dhahran headquarters on Oct 22; Libya trims output after a pipeline valve closureReuters said Saudi Aramco evacuated its Dhahran headquarters as fighting with the Houthis intensified, and that Libya's National Oil Corporation shut a pipeline valve, cutting output at the Hamada and Tahara fields. 'The market is concerned about these continued Iranian attacks,' said Andrew Lipow of Lipow Oil Associates (Baird Maritime/Reuters).
  • B2Russian diesel cargo bound for New York sails under the Trump-Moscow arrangementReuters said a shipment of Russian diesel headed for New York has departed under the agreement between the Trump administration and Moscow; the vessel and volume were not identified (Baird Maritime/Reuters).
  • C3Iranian state TV claims 'non-compliant' ships have stopped moving through HormuzCBS News said Iranian state TV claimed on Oct 23 that movement of 'non-compliant' vessels through the Strait of Hormuz had completely halted after attacks on ships and navigation systems. The claim comes from a party to the conflict and has not been independently verified (CBS News).

Watchlist next 12–48 hours and beyond

  • Sat–Sun, Oct 24–25
    Whether the U.S. strikes Iran after Barrack's remark; Champi's track toward the Chinese coast and southern Japan and when Taiwan lifts its warnings
  • Tue, Oct 27
    Israel's general election; the Oleshky ceasefire start according to Ukraine's ombudsman (the White House says Oct 29)
  • Tue–Wed, Oct 27–28
    FOMC meeting and rate decision, plus any signal on December
  • Next week
    Iranian President Pezeshkian's trip to Moscow and talks with Putin
  • Through Sat, Oct 31
    North Korea's answer to Seoul's talks offer and any loudspeaker broadcasts, whether U.S. forces strike the Houthis in Yemen, and whether the PHP2Shell CVEs join CISA's KEV list
  • Tue, Nov 3
    Midterm elections and the deadline for our call on U.S. strikes on Iranian territory
PPentagon Pizza IndexFri, Oct 23 17:15 ETSIDE INDICATOR

Side indicator · Pentagon Pizza Index, for interest only — not used in threat judgments

55
DOUGHCON 3
ELEVATED · activity rising at multiple stores
8 monitored stores · busyness vs. normal
54321
  • Domino's1.4 miQuiet
  • Extreme Pizza0.5 mi+11%
  • District Pizza Palace1.0 mi+70%
  • Papa John's1.8 mi+11%
  • Pizza Hut2.1 mi+60%
  • Wiseguys Pizza0.8 miQuiet
  • Fire Works Pizza1.2 mi+3%
  • Lost Dog Cafe2.3 mi+8%
Cross-check · 2 sitesSINGLE SOURCE
uspizzaindex.comDOUGHCON 317:15 ET

PizzINT could not be read, so this reading is single-source.

Today's sliceThis round's Pizza Index is single-source again: pizzint.watch timed out after 90 seconds, so there's no cross-check — no second DOUGHCON reading, no shared-store comparison and no way to tell whether a shop one site lists as closed shows up as a spike on the other. uspizzaindex.com alone reads DOUGHCON 3 (gauge 55, 'ELEVATED'). The snapshot was taken at 5:15 p.m. ET on Friday, Oct 23 — nowhere near the 10 p.m.–2 a.m. late-night window and right as the Friday dinner rush gets going — so District Pizza Palace (+70%) and Pizza Hut (+60%) showing 'much busier than usual' reads more like the weekend kicking off than anything else. The labels wobble a bit too: Extreme Pizza and Papa John's are both up 11%, yet one is 'busier than usual' and the other 'usual.' Call it a Friday-night pizza check and leave it at that.
Pentagon Pizza Index (uspizzaindex.com), estimates based on Google Popular Times · uspizzaindex.com

Edition archiveRSS

$Markets
Brent
$111.66
▲ +2.76%
WTI
$103.44
▲ +3.99%
Gold
$4,010.00
▼ -1.24%
Silver
$53.96
▼ -1.90%
Dow
52,215.16
▼ -1.23%
S&P 500
7,623.68
▼ -0.52%
Nasdaq
25,955.34
▼ -0.21%
U.S. 10Y yield
4.988%
▲ +4bp
VIX
19.45
▲ +2.21%
USD/KRW
1,323.66
▼ -0.13%
Bitcoin
$81,330
▲ +0.02%
Collected Fri, Oct 23 17:15 ET · each tile shows its quote time
Green = up, red = down (U.S. convention). Hover a tile for its source.
CCyberTop 2A1
CYB-02CISA adds

CISA adds exploited Arista VeloCloud and Collabora flaws to its KEV catalog; attackers planted web shells on Nextcloud servers a month before the advisory

CISA added CVE-2026-114625, a SQL injection flaw in Arista VeloCloud Orchestrator, and CVE-2026-110447, an OS command injection flaw in Collabora Online's built-in CODE server, to its Known Exploited Vulnerabilities catalog on Oct 23, each based on evidence of active exploitation (CISA). According to BleepingComputer, CVE-2026-110447 affects the Nextcloud app richdocumentscode before version 26.4.303 and lets attackers run OS commands through the proxy.php endpoint, with no authentication or user interaction, whenever the built-in server is stopped after a restart, upgrade or crash. A fix shipped on Sept 11, but the advisory and CVE were not published until Oct 14; attacks began in mid-September, and attackers planted PHP web shells and hunted for password databases, password manager files and cryptocurrency wallets (BleepingComputer). eSecurity Planet said exploitation has been seen since Sept 10 and advised admins to upgrade or remove the app — disabling it is not enough — and to hunt for unexpected PHP files in apps/richdocumentscode and review logs back to Sept 10 for suspicious proxy.php requests. Standalone Collabora Online servers, Docker and RPM/DEB installs and Nextcloud All-in-One deployments are not affected (BleepingComputer, eSecurity Planet). Some reports say ransomware operators also exploited the flaw, but that has not been independently confirmed (BleepingComputer).

Analytic judgmentExploitation began a month before the advisory and leaves web shells that survive patching, so there is roughly an even chance that a national CERT or Nextcloud issues a separate alert or indicators of compromise for CVE-2026-110447 exploitation by Nov 6, 2026.
Likelihood Roughly even chance (45–55%)Confidence Low
  • Indicators to watch · Federal remediation deadlines attached to the KEV listings, new indicators of compromise from Nextcloud or Collabora, national CERT alerts, reported VeloCloud Orchestrator compromises at managed service providers, whether the PHP2Shell CVEs (CVE-2026-109618 and CVE-2026-109619) join the KEV list
KKorea & Indo-PacificTop 5B1
KOR-05Seoul formally

Seoul formally proposes military talks to pin down the inter-Korean border and restore hotlines; Pyongyang ignored a similar offer last year, and experts expect no reply

Kim Hong-cheol, South Korea's deputy defense minister for policy, formally proposed on Oct 23 that the two Koreas' militaries hold talks to 'mutually verify the clear location of the ground Military Demarcation Line, restore military communication lines, and discuss measures to prevent accidental clashes in border areas,' adding that three-way talks including the U.N. Command are possible and that the schedule and venue could be arranged through Panmunjom (Korea Herald, NK News). Seoul made a similar proposal last November, which Pyongyang did not answer (Korea Herald). The Korea Herald said only about 200 of the original 1,292 MDL marker posts can still be identified, and that South Korea relies on U.S. National Geospatial-Intelligence Agency maps, the U.N. Command on 2016 coordinates and North Korea on its own markers. According to the Korea JoongAng Daily, military communication lines are currently down, and Lim Eul-chul of Kyungnam University said the North is unlikely to respond because it views finishing its border fortifications as the last step in its 'two hostile states' framework. The offer follows a Sept 21 mine blast inside the DMZ that wounded South Korean soldiers, repeated MDL crossings by North Korean troops that drew warning broadcasts and warning shots, and Kim Yo Jong's threat to restart propaganda loudspeakers (Korea Herald, Korea JoongAng Daily). We found no official North Korean response during the window.

Analytic judgmentNorth Korea ignored the same kind of offer last November, is finishing its border fortifications under its 'two hostile states' line and experts expect no reply, so it is very unlikely that Pyongyang agrees to or holds military talks with Seoul by Nov 30, 2026.
Likelihood Very unlikely (05–20%)Confidence Moderate
Scored callDue 2026-11-30 · Resolves yes if, between Oct 23 00:00 and Nov 30 23:59 Korea time, North Korea's KCNA or another official North Korean outlet or channel announces that it accepts military talks with South Korea, South Korea's Defense Ministry or Unification Ministry says the North has agreed to hold them, or military talks between the two Koreas (including a three-way format with the U.N. Command) are held in person. Rejections or criticism of the proposal, restoration of communication lines or exchanges of messages without agreement to talks, and contacts between North Korea and the U.N. Command alone do not count. Sources: KCNA, South Korean Defense and Unification ministry announcements, Yonhap, Reuters and AP reporting. Scorecard →
  • Indicators to watch · Any KCNA or Kim Yo Jong statement on the offer, whether the Panmunjom liaison channel answers, actual North Korean loudspeaker broadcasts and JCS confirmation, warning broadcasts and warning shots along the MDL
KKorean Peninsula & Indo-PacificKOR2 items
KOR · Indo-PacificTyphoon Champi

B1Typhoon Champi skirts northeastern Taiwan and turns north; northern and central Taiwan close again Saturday

Taiwan's Central Weather Administration said Champi's center was about 100 km east of Yilan at 8 p.m. Friday, moving north-northeast at 16 kph, and is forecast to pass off northeastern Taiwan, turn toward the Chinese coast and move into southern Japan. Taipei, New Taipei and 10 other areas suspended work and classes for a second day on Saturday, and up to 900 mm of rain was forecast in the mountains (Taipei Times, RTI).

  • —North Korean loudspeaker broadcastsNo notable developments confirmed. We found no JCS confirmation of North Korean loudspeaker broadcasts toward the South during the window.

U.S. Impact Assessment

  • Energy & fuel costsReuters says Brent hit its highest since late April; the collected quotes are $111.66 (+2.76%) for Brent and $103.44 (+3.99%) for WTI. With a record number of ship attacks around Hormuz this month and a U.S. envoy openly floating a weekend strike, refiners, airlines, truckers and chemical makers should plan for elevated crude and diesel costs into November and be ready for a volatile open on Monday if the weekend brings military action.
  • Cyber exposureThe KEV listings put the VeloCloud and Collabora flaws on a federal remediation clock, and contractors that share networks with agencies should match it. Organizations running Nextcloud's built-in CODE server app should upgrade to 26.4.303 or remove the app, then hunt for stray PHP files and suspicious proxy.php requests back to Sept 10, since patching alone will not remove web shells. The PwC and Quest incidents are a reminder to review what data training, lab and other hosted platforms hold and who can reach it.
  • Shipping & Gulf infrastructureTwenty-eight attacks this month and 11 damaged supertankers will keep war-risk cover for Gulf calls expensive, and operators should expect more delays around Umm Al Quwain and Sharjah while the slick is cleaned up. Reuters' report that Iran has plans to cut Gulf undersea cables puts U.S. cloud, data center and telecom operators in the region on notice to check route diversity and failover.
  • Rates & financingThe 10-year yield sits at 4.988% (+4bp), and economists see a December hike as close to certain even before oil's latest jump feeds into inflation. Borrowers planning to issue debt or refinance before year-end should build a December hike into their assumptions, and companies leaning on AI capex should expect investors to keep pressing on returns.

Intelligence gaps · unconfirmed

  • Market data conflicts: The AP said Brent settled up 3.1% at $116.72 on Oct 23, Reuters (Baird Maritime) put it at $117.18 (+3.54%) and UPI at $116.46 (+2.9%, with an intraday high of $117.45), all well above the collected $111.66 (+2.76%), and we could not establish why; we used only the collected quotes. WTI was $103.22 (+3.77%) per Reuters and $103.12 (+3.7%) per UPI, close to the collected $103.44 (+3.99%). The AP called Brent's level the highest since June 2022, while Reuters and UPI said the highest since late April. The AP's 4.99% for the 10-year yield matches the collected 4.988%.
  • UAE oil spill: Reuters put the slick at about 160 sq km and about 25 km off Umm Al Quwain, while The New Arab and SBS said 190 sq km and within about 6 km of shore. Reuters (Baird Maritime) said authorities had not identified the tanker, while CBS News and SBS said it was confirmed as the Gem No.2, so it is unclear who made the identification. BBC reports could not be opened.
  • U.S.-Iran: AFP said Barrack spoke in a podcast interview with Mario Nawfal, while CBS News said he spoke to Israeli radio. Trump's 'I don't know anything about it' response was confirmed only in Mediaite's account. CNBC's report that investors increasingly expect U.S. strikes to resume within weeks and The Hill's oil story returned 403 errors, so we left them out. A Trump remark that 'we could take all of the oil' and Ambassador Mike Waltz's comment to the Financial Times that the war could last another year appeared only in CBS News' live blog.
  • Oleshky: The White House, Euronews and The New York Times put the start on Thursday, Oct 29, while Ukraine's ombudsman told AP it begins Tuesday, Oct 27, at 4 a.m. Moscow time. BBC, CBC and Guardian reports could not be opened.
  • Korean Peninsula: The Korea Herald and NK News said the Sept 21 mine blast wounded three soldiers, while the Korea JoongAng Daily said two. A Dong-A Ilbo exclusive that Seoul sent liaison officers last month to both the U.S.-led and the U.K.-France-led Hormuz coalitions could not be opened or confirmed elsewhere, so we left it out; a Newspim report that U.S. RC-135S Cobra Ball and RC-135V/W Rivet Joint aircraft landed at Osan was also unverified, and Yonhap's site was unreachable.
  • Cyber: Quest has not said how many patients were affected. PwC did not confirm the volume of data Everest claims to have stolen, and an Oct 28 publication deadline attributed to Everest is unverified. We could not open the original k0t research or The Hacker News article, and Reuters' report on Iran's undersea-cable plans rests on anonymous officials and was not confirmed by other outlets.
  • Starlink: UPI dated the start of the cap to Oct 13, while earlier reports said Oct 14. We found no follow-up to Secretary Rubio's promised 48-hour answer.
  • Pending grading: 'cisa-kev-velocloud-114625-nov12' appears to have happened — CISA added CVE-2026-114625 to the KEV catalog on Oct 23. 'riyadh-airport-reopens-oct31' also appears to have happened — the AP reported that Saudia and Flynas flights took off and landed at King Khalid International Airport on Wednesday, Oct 21. 'witkoff-putin-russia-meeting-nov15' appears to have happened as well — APA (Azerbaijan) reported a three-hour-plus meeting at the Konstantinovsky Palace in St. Petersburg on Oct 21 — but we could not open Reuters or AP accounts. 'cisa-kev-sonicwall-cve-2026-102255-oct25' was not among the KEV additions on Oct 20 (six CVEs) or Oct 23 (two). For 'taiwan-champi-landfall-oct26,' Champi's center was about 100 km east of Yilan moving north-northeast at 8 p.m. Friday.
  • Other: BBC reports that President Macron called a deadly shooting near Paris a 'racist terrorist attack' and that Israeli forces began demolishing buildings in Hebron after two soldiers were shot could not be opened. We could not find the Reuters exclusive on a Saudi missile plant expansion. Israel's Oct 27 election date was confirmed only through AFP.
SSupply Chain & LogisticsTop 1B1
SCM-01Ship attacks

Ship attacks around Hormuz hit a record in October and oil from a stricken tanker reaches UAE beaches; a U.S. envoy says an Iran strike 'absolutely' could come this weekend, but Trump says he knows nothing about it

Reuters, citing the Washington Institute for Near East Policy, said October has seen 28 confirmed attacks on ships in the Strait of Hormuz and surrounding waters, the most on record, bringing the total since the conflict began on Feb 28 to 113; 11 VLCCs were damaged in October alone. UKMTO had logged 135 incidents tied to the U.S.-Iran conflict as of Oct 16 and noted a sharp rise in attack damage this month (BOE Report/Reuters). UKMTO also said a tanker was hit by an unknown projectile at 1715 UTC on Oct 22 while sailing outbound about 7 nautical miles northeast of Limah, Oman, and was able to continue to its next port of call (Arab Times). The UAE's Ministry of Climate Change and Environment said on Oct 23 that oil from a tanker had washed ashore at Umm Al Quwain, north of Dubai, closed nearby beaches and began containment, and Sharjah restricted access to Al Hamriyah Beach; the oil was traced to the Panama-flagged tanker Gem No.2, which caught fire after being struck by an unidentified projectile off the UAE on Oct 9 (bdnews24/Reuters, The New Arab, SBS). Tom Barrack, the U.S. ambassador to Turkey, said in an interview, 'Could there be a strike this weekend? Absolutely,' while stressing that 'the consequence won't be regime change' and that President Trump remains open to talks (Arab News/AFP, Times of Israel). Asked about the remark after landing in Florida, Trump said, 'Well, if that's the case, I don't know anything about it' (Mediaite). Reuters said Brent climbed to its highest since late April and that Saudi Aramco evacuated its Dhahran headquarters on Oct 22 as fighting with the Houthis intensified (Baird Maritime/Reuters). As of collection, Brent is at $111.66 (+2.76%) and WTI at $103.44 (+3.99%).

Analytic judgmentBarrack said a weekend strike is 'absolutely' possible, but the president distanced himself from the remark, and AFP reported that Trump had previously indicated there would be no strikes before the Nov 3 midterms, so it is unlikely that U.S. forces strike a target on Iranian territory by Nov 3, 2026.
Likelihood Unlikely (20–45%)Confidence Moderate
Scored callDue 2026-11-03 · Resolves yes if, between Oct 8 00:00 and Nov 3 23:59 ET, CENTCOM, the Pentagon or the White House announces, or Reuters or AP reports citing U.S. officials, that U.S. aircraft, missiles or drones struck a target on Iran's mainland or on an Iranian island. Attacks on vessels at sea, interceptions, cyber operations and Israel-only strikes do not count. Sources: CENTCOM statements, Reuters and AP reporting. Scorecard →
  • Indicators to watch · CENTCOM or Pentagon notices of operations against Iran and any White House deadline for talks, UKMTO advisories and the identities of damaged vessels, the spread of the Umm Al Quwain slick and coastal desalination operations, Gulf war-risk premiums
MMarkets & FinanceTop 4B1
MKT-04Stocks slip

Stocks slip as oil climbs and AI costs weigh; the Dow drops 1.23% while economists overwhelmingly expect the Fed to hold next week and hike in December

The AP said about three of every four stocks in the S&P 500 fell on Friday, Oct 23, as rising oil prices weighed on the market and investors fretted over AI valuations and high borrowing costs; energy names such as Chevron and ConocoPhillips gained, while American Express, Caterpillar, JPMorgan Chase and Citigroup fell. Edward Jones senior global strategist Angelo Kourkafas said, 'Investors appear increasingly focused on the economics of AI, particularly the substantial upfront costs required to build AI infrastructure' (BNN Bloomberg/AP). In a Reuters poll taken Oct 16–20, 94 of 100 economists expected the Fed to hold its 3.75%–4.00% target range at the Oct 27–28 meeting and all 100 expected a hike in December, up from fewer than half in last month's poll (Kitco/Reuters). TD Securities also expects a hold next week followed by hikes in December and March, saying, 'Barring an unexpected shock, the December rate hike is all but locked in' (FXStreet). As of collection, the Dow is at 52,215.16 (-1.23%), the S&P 500 at 7,623.68 (-0.52%), the Nasdaq at 25,955.34 (-0.21%), the 10-year yield at 4.988% (+4bp) and the VIX at 19.45 (+2.21%).

Analytic judgmentWith 94 of 100 economists in the Reuters poll expecting a hold and TD Securities treating a December move as its base case, it is very unlikely that the Fed raises the federal funds target range at its Oct 27–28, 2026 FOMC meeting.
Likelihood Very unlikely (05–20%)Confidence High
Scored callDue 2026-10-28 · Resolves yes if the FOMC statement released Oct 28 raises the federal funds target range; a hold or a cut resolves no. Sources: Federal Reserve FOMC statement (federalreserve.gov), Reuters and AP reporting. Scorecard →
  • Indicators to watch · The Oct 28 FOMC statement and any signal on December, inflation expectations as oil climbs, AI capex guidance in next week's megacap earnings, the 10-year yield
GGeopolitics & SecurityGEO4 items
GEO · SecurityEuropean Middle

B2European and Middle Eastern foreign ministers meet in Istanbul for the first time and urge 'utmost restraint' on Washington and Tehran

Foreign ministers from Britain, France, Germany, Italy, Turkey, Saudi Arabia, Pakistan and Egypt met in Istanbul on Oct 23 to discuss Hormuz, the Bab el-Mandeb, Houthi attacks on Saudi Arabia and the war in Ukraine. France's Jean-Noël Barrot said the group would call on both sides to exercise 'the utmost restraint,' Turkey's Hakan Fidan said 'diplomacy and dialogue are the only way forward,' and the countries agreed to keep meeting regularly; France has pledged to help protect Saudi Arabia's Yanbu oil terminal (France 24/AFP, Gulf News).

  • B1Gunmen kill seven at a church funeral in Jordan's KarakThree gunmen opened fire on a funeral procession at a Greek Orthodox church in Hammoud village in Karak governorate on Oct 23, killing seven and wounding 34. The interior minister blamed 'a group of extremists,' King Abdullah II vowed to 'strike with an iron fist,' and a manhunt is under way (PBS NewsHour/AP, CBS News).
  • B2Iran's President Pezeshkian to meet Putin in Moscow next weekIranian Foreign Minister Abbas Araghchi said on Oct 23 that President Masoud Pezeshkian will travel to Moscow next week for talks with Vladimir Putin on political and economic cooperation and their comprehensive strategic partnership (CBS News, SBS).
  • B2Kyiv says its Starlink speed cap is still in placeUPI said Ukrainian Defense Ministry officials reported on the morning of Oct 23 that Starlink terminals on drones are still throttled above 100 mph, with one saying, 'Overall, nothing has changed anywhere,' and another that there is 'currently no confirmation that these restrictions have been lifted.'
CCyberCYB4 items
CYB · CyberPwC confirms

B2PwC confirms an incident at a vendor hosting employee training records after the Everest group claims 590 GB

PwC said on Oct 23 it was aware of a cybersecurity incident involving a third-party vendor that hosts employee learning records; a spokesperson said 'the affected site does not house client data, sensitive personal data or financial information' and that its network and operations were not affected (Global Banking & Finance Review/Reuters). The extortion group Everest had claimed a day earlier to have stolen 590 GB of HR and training data; PwC did not confirm the volume (Cyber Security News).

  • A1Quest Diagnostics says an intruder accessed patient records through its Quanum ordering systemQuest said in an SEC 8-K filing that on Oct 21 it learned of unauthorized access to its Quanum LSM system, which clients use to order tests and look up results, and that it 'believes that an unauthorized party accessed certain patient records'; the incident has not materially disrupted operations (SEC). TechCrunch said Quest has not disclosed how many patients were affected.
  • C2'k0t' campaign against Fortinet and Palo Alto edge devices exposes more than 70,000 credentialsGroup-IB and NyxLab said a threat actor called k0t targeted FortiGate, FortiWeb and GlobalProtect devices using a FortiWeb path traversal flaw (CVE-2025-64446), a PAN-OS authentication bypass (CVE-2026-0257) and brute-force logins, exposing more than 70,000 credentials and related records; the researchers said not every credential led to a confirmed compromise (Cyber Security News).
  • B3Reuters: Iran has plans to hit Gulf undersea cables if the war resumesReuters, citing two senior Iranian security officials, reported that Tehran has detailed plans to target undersea communications cables in the Gulf and obstruct repairs if it is attacked again, and IRGC political deputy Yadollah Javani pointed to seven major internet cables under the Strait of Hormuz. The officials gave few operational details (Algemeiner/Reuters).

Sources 41

Grading: source and information reliability use the Admiralty (NATO) 6×6 scale (A–F / 1–6); judgments use ICD 203 likelihood language with analytic confidence (high · moderate · low). Major items are cross-checked against at least two independent sources; single-source items are listed under intelligence gaps.

Market colors follow U.S. convention: green for gains, red for losses. The Pentagon Pizza Index is a side indicator shown for interest only — public figures from uspizzaindex.com, cross-checked with pizzint.watch — and is not used in the threat level or any judgment. This page is open-source reference material, not investment advice.