Riyadh residents received a mobile phone alert warning of a potential hostile aerial threat at 3:42 a.m. local time on Monday, Oct 26, followed minutes later by a notice that the threat had passed (Arab News, Aaj English TV). Coalition spokesman Maj. Gen. Turki Al-Maliki said on X that Saudi air defenses intercepted a ballistic missile fired toward Riyadh and that the coalition destroyed two ballistic missile launch platforms in the Houthi-held capital, Sanaa, one of which was used in the attack. 'Operations continue to dismantle the terrorist Houthi militia's ballistic missile network,' he said (Arab News). Houthi military spokesman Yahya Saree claimed the group targeted Riyadh's airport with a ballistic missile and oil pumping stations with drones (Aaj English TV), and said ballistic missiles struck Saudi positions and weapons depots in the Salah al-Din area of Aden and the Al-Wahat area of Lahij, 'resulting in dozens of dead and wounded' (Anadolu). None of those claims has been confirmed by Saudi Arabia, Yemen's government or independent sources. Arab News said two people, a Saudi citizen and an Asian expatriate, were hurt in Khamis Mushait and Ahad Rafidah on Oct 25.

• Indicators to watch · Statements by the Houthi military spokesman or Supreme Political Council; further coalition strikes in Yemen; the frequency of Riyadh civil defense alerts; Saudi notices on oil facility damage; anything Iran says about the Houthis after the Tehran talks

• B2Venezuela's Machado returns from exile; Rubio credits U.S.-backed reconciliation talksOpposition leader María Corina Machado reappeared at a church in Lara state on Oct 25 after more than 10 months abroad, posting 'I am here. With you.' Secretary of State Marco Rubio said her safe return was 'the direct result of the U.S. supported reconciliation talks,' as pressure grows on acting President Delcy Rodríguez to set a presidential election (Al Jazeera).
• C2Germany reportedly near a first purchase of Ukrainian Bars cruise missilesCiting the Financial Times, 1news.az reported that Germany expects to sign a deal in the coming weeks for a first batch of Ukraine's jet-powered Bars missiles (range up to 1,000 km), with Bundeswehr tests in early 2027 and possible orders for hundreds more; it would be the first known German purchase of Ukrainian-developed offensive weapons.
• B2Uganda orders 21-day quarantine for travelers returning from Congo as the Ebola outbreak spreadsHealth Minister Chris Baryomunsi announced the self-paid quarantine on Oct 25. Congo had recorded 9,704 cases and 4,687 deaths by Oct 20 in an outbreak of the Bundibugyo strain, which has no approved vaccine, and Kenya has reported two deaths and Nigeria one confirmed case (Al Jazeera).

• B2Millions of hacking attempts follow critical PHP flaws, knocking some government and corporate sites offlineReuters said critical vulnerabilities in PHP, which underpins much of the internet, triggered millions of hacking attempts and took government and company websites in Japan, Europe and elsewhere offline; experts said AI is automating vulnerability scanning and phishing, making cybercrime faster and cheaper.

Intelligence gaps · unconfirmed

• Price conflicts: Reuters put Brent at $114.51 to $115.23 during Asian trading on Oct 26 and AP at $110.12 to $110.23, a gap that likely reflects different contract months, and both differ from the collected $109.71. Reuters described last week's level as near a six-month high, AP as the highest in more than four years. Reuters also cited a 10-year Treasury yield different from the collected Friday quote of 4.988%. Only collected quotes are used in the text.
• Tehran talks: HELIOS could not confirm that the Saudi, Pakistani and Turkish delegations arrived or what was agreed by the end of the window. The makeup of the Qatari delegation and the content of its talks were not disclosed. Rayed Krimly's exact title could not be confirmed from the article text.
• Houthi claims: the drone strikes on oil pumping stations and the 'dozens of dead and wounded' at Saudi positions in Aden and Lahij have not been confirmed by Saudi Arabia, Yemen's government or independent sources. The destruction of two launchers in Sanaa rests on the coalition's own statement; HELIOS could not open the original Reuters or AP reports.
• Kospi flows: Asia Today put foreign net selling at 695.5 billion won; another report cited 696.2 billion won, reflecting different tally times.
• Mirae Asset Life: the number of affected customers, the data fields taken, the intrusion path and the attacker have not been disclosed, and HELIOS found no statement from the Financial Services Commission or Financial Supervisory Service.
• Germany's Bars purchase rests on a single Financial Times report relayed by 1news.az; HELIOS could not open the FT article and found no German government confirmation.
• Black Sea figures (570 vessels, 40 deaths) come from a Financial Times report citing Ambrey and the IMO, as relayed by South Korean outlets; HELIOS could not open the FT article.
• PHP2Shell (CVE-2026-109618 and CVE-2026-109619): HELIOS could not newly confirm during this window whether CISA has added either CVE to its KEV catalog; security vendor pages said neither was listed as of Oct 25.
• Pending resolution: 'kr-financial-hack-new-disclosure-oct31' appears to have been met by Mirae Asset Life's Oct 26 hacking disclosure (KB Kookmin's revised count is a follow-up to an earlier incident and is excluded). For 'taiwan-champi-landfall-oct26', HELIOS found no Central Weather Administration statement of landfall on Taiwan's main island during this window.

Mirae Asset Life said it detected abnormal activity on some systems on Oct 25 and, after analysis with outside specialists, confirmed early on Oct 26 that customers' personal credit information had been leaked (Financial News, Newspim). The intrusion hit its customer subscription system and parts of its website, and the company said it is still working with outside experts to determine the scope and which data fields were taken. It blocked the attackers' IP addresses, temporarily took its website offline and warned customers about identity theft, smishing and phishing (Financial News, Global Economic). Newspim said it is the first time a South Korean insurer has confirmed and reported a hacking-related customer data leak to authorities. Separately, KB Kookmin Bank said a detailed re-review of an earlier hacking incident raised the number of people affected from 119 to 2,210, adding 1,631 customers and 460 current and former employees; exposed customer data included names, dates of birth, encrypted resident registration numbers, addresses, phone numbers, account numbers, deposit balances and loan histories, and the bank has shut down the affected system and servers and is notifying those affected (Newspim).

• Indicators to watch · Mirae Asset Life notices on scope and data fields; statements by the Financial Services Commission and Financial Supervisory Service; new breach disclosures at other Korean insurers, card companies or brokerages; smishing campaigns that exploit the leaked data

KCNA reported on Oct 26 that North Korea's permanent representative to the United Nations sent a letter to the president of the U.N. Security Council on Sunday, Oct 25 (The Korea Herald/Yonhap, UPI). The letter called the Sept. 21 mine blasts in the Demilitarized Zone a 'sinister obstructive move' fabricated by Seoul to delay and impede the North's fortification work along its southern border, defended that work as a 'legitimate' act of self-defense under Article 51 of the U.N. Charter and accused South Korean troops of firing warning shots at North Korean personnel (The Korea Herald). The Sept. 21 explosions wounded three South Korean soldiers, two seriously, and Seoul's military concluded that North Korean troops planted the mines south of the Military Demarcation Line, a finding Pyongyang rejects (UPI). South Korea's U.N. ambassador, Cha Ji-hoon, sent the council a letter on Thursday, Oct 22, laying out the investigation, citing a violation of the armistice and urging the North to take responsibility and engage in dialogue (The Korea Herald). UPI said Seoul has proposed military talks to jointly verify the boundary and to restore communication channels. At a briefing on Oct 26, Unification Ministry spokesman Yoon Min-ho said Seoul hopes Kim Jong Un's one-day Oct 24 visit to Dandong will contribute constructively to peace on the peninsula and to resuming dialogue among neighboring countries, and said the government is 'closely watching' and will play its role when asked about reports of North Korea-U.S. summit coordination (Financial News, Nocut News).

• Indicators to watch · KCNA's response to Seoul's talks proposal; JCS reports on activity along the Military Demarcation Line; whether the North starts the loudspeaker broadcasts it promised for October; any Security Council scheduling; follow-up to Kim's China visit

• —No JCS confirmation of North Korean loudspeaker broadcasts during the windowHELIOS found no JCS or Defense Ministry confirmation that North Korea has switched on the loudspeakers Kim Yo Jong said on Oct 21 would operate along the border in October. No notable activity confirmed.

U.S. Impact Assessment

• Energy and fuel costsCollected quotes put Brent at $109.71 (-1.78%) and WTI at $100.94 (-2.26%) as mediation picks up, but the Houthis claimed new strikes on Saudi oil pumping stations the same day and Hormuz traffic remains far below normal. Refiners, airlines and freight-heavy shippers should treat the pullback as fragile and tie fuel procurement and surcharge decisions to the outcome of the Tehran talks and the Houthi tempo.
• Cyber exposure through Asian financial affiliatesBack-to-back intrusions at a South Korean bank and insurer, alongside Japan's run of breach compensation payouts, show attackers working through internet-facing customer systems. U.S. institutions with Korean or Japanese affiliates, vendors or shared platforms should review access logs on web and application front ends, confirm PHP patch levels and prepare customers for phishing that exploits leaked data.
• Defense posture on the Korean PeninsulaNorth Korea's letter rejects Seoul's findings on the DMZ mine blasts and invokes self-defense, keeping the risk of incidents along the border alive. Defense contractors and companies with staff in South Korea should track JCS announcements, especially whether the North follows through on the loudspeaker broadcasts it promised for October.
• Brazil political riskLula's win and Bolsonaro's push to annul the result add political risk to U.S. exposure in Brazil, with Brazilian assets sliding in early Asian trading. Companies with Brazilian operations should watch court rulings on the annulment request and any protests.

Sources 34

• B
  Business Recorder (Reuters)Oil drops from near six-month highs on hopes Iran war hostilities to ease
  B
• K
  Khaama PressSaudi, Pakistan and Turkey Officials Meet Iran in Tehran
  C
• Y
  Yahoo NewsOfficials from Mecca pact states to hold talks in Iran amid regional tensions
  C
• T
  The Tribune (ANI)Iran says Saudi, Pakistani, Turkish officials to visit Tehran for regional security talks
  C
• A
  Arab NewsCoalition destroys Houthi missile launchers in Sanaa after foiled attack on Riyadh
  C
• A
  Aaj English TVSaudi coalition destroys two Houthi missile launchers after Riyadh attack
  C
• A
  Anadolu AgencyHouthis claim missile attacks on Saudi forces in Yemen's Aden, Lahij
  B
• A
  Asia TodayForeign investors sell 700 billion won, Kospi falls to 5,469, a seven-month low (translated headline)
  B
• K
  KSAT (AP)Shares are mixed in Asia after a decline on Wall Street, and oil prices fall more than 1%
  B
• M
  Money TodayWon at 1,323.1 per dollar despite a strong dollar, a new low for the year (translated headline)
  B
• M
  MarketScreener (Reuters)Currency markets subdued ahead of busy central bank week
  B
• F
  Financial NewsHacking leak confirmed at Mirae Asset Life too, the first breach among insurers (translated headline)
  B
• N
  NewspimMirae Asset Life customer data leaked in hack, the insurance industry's first case (translated headline)
  C
• G
  Global EconomicMirae Asset Life customer personal data leaked, first insurer hacking case (translated headline)
  C
• N
  NewspimKB Kookmin Bank hacking leak grows to 2,210 people as 2,091 more are identified (translated headline)
  C
• T
  The Korea Herald (Yonhap)N. Korea sends letter to UNSC calling DMZ mine blast S. Korean fabrication
  B
• U
  UPINorth Korea calls DMZ mine blasts 'fabricated' in letter to UNSC
  B
• F
  Financial NewsUnification Ministry says Kim's China trip should contribute to peace, 'closely watching' reports of North Korea-U.S. summit coordination (translated headline)
  B
• N
  Nocut NewsWill Kim's China visit lead to North Korea-U.S. dialogue? Unification Ministry says it hopes so and the government will play its role (translated headline)
  B
• T
  The Korea Times (Reuters)Brazil's Lula wins historic fourth term, Flavio Bolsonaro refuses to concede
  B
• F
  France 24Brazil's Lula beats odds and seals re-election, rival Bolsonaro demands annulment
  B
• C
  CBS NewsLula wins fourth term as Brazil's president, beating Flávio Bolsonaro in runoff, but Bolsonaro rejects results
  B
• T
  TASS'Student List' wins 52% of vote, Vucic's supporters get 39% — Serbian electoral commission
  C
• E
  EuronewsStudent List wins Serbian election in political earthquake as Vučić concedes defeat
  B
• U
  Ukrainska PravdaRussia attacks Ukraine with 140 drones and four missiles: air defences downs 112 drones and three missiles
  C
• A
  Al JazeeraUganda orders 21-day Ebola quarantine for citizens returning from DR Congo
  B
• H
  HankyungThe Black Sea, more dangerous than Hormuz: 570 ships hit, 40 dead (translated headline)
  B
• i
  iNews24More than 570 ships hit in the Black Sea this year, 'more dangerous than Hormuz' (translated headline)
  C
• S
  Seoul ShinmunU.S. commander tours Hormuz by helicopter saying the mines are cleared, but tankers are still jittery (translated headline)
  B
• T
  Taipei TimesTaiwan plans to build rare earths plant
  B
• S
  Seoul Economic DailyChina's Communist Party Opens Plenum Focused on Party Discipline
  B
• Y
  Yahoo News (Reuters)China's Communist Party opens fifth plenum
  B
• A
  Al JazeeraVenezuela's opposition leader Maria Corina Machado returns from exile
  B
• 1
  1news.az (citing the Financial Times)Germany intends to purchase Ukrainian cruise missiles
  C

Qatari mediators traveled to Tehran on Sunday, Oct 25, as part of a U.S.-coordinated effort to ease regional tensions, and officials from Saudi Arabia, Turkey and Pakistan were set to meet Iranian leaders in Tehran on Monday, Reuters reported (via Business Recorder). Ali Bagheri, deputy secretary of Iran's Supreme National Security Council, told state broadcaster IRIB that Saudi Defense Minister Prince Khalid bin Salman, Pakistan's army chief Field Marshal Asim Munir and Turkish intelligence chief Ibrahim Kalin were coming to discuss regional security, with the Iranian side led by council secretary Mohsen Rezaei (The Tribune/ANI). 'Iran's strategic policy is to ensure regional security through regional countries and confront any foreign interference,' Bagheri said. Saudi official Rayed Krimly said the visit aims at 'de-escalation between parties involved in the ongoing crisis' and supports mediation by Qatar and Pakistan (Yahoo News). It is the first high-level contact between Iran and all three members of the Mecca defense pact, signed in August, which treats an armed attack on any member as an attack on all, since the Houthis escalated attacks on Saudi Arabia (Khaama Press, Yahoo News). No outcome had been announced by the end of the collection window. Oil pared part of last week's rally; 'Concerns over renewed military hostilities in the Middle East, which drove much of last week's crude rally, have eased this morning, but the reprieve may prove temporary,' said Vandana Hari, founder of Vanda Insights (Reuters). Collected quotes show Brent at $109.71 (-1.78%) and WTI at $100.94 (-2.26%). HELIOS found no CENTCOM, Pentagon or White House announcement of a strike on Iranian territory during the window.

• Indicators to watch · Any readout from the Tehran talks by Iran's Supreme National Security Council or the Saudi Defense Ministry; what Qatar says about its mediation; the tempo of Houthi attacks; CENTCOM announcements on Iran; activity around Israel's Oct 27 election

Major currencies traded in tight ranges on Monday at the start of a week packed with central bank decisions and corporate earnings, as a pullback in oil prices and Treasury yields weighed on the dollar, Reuters reported. Five major central banks announce decisions later in the week; the Fed, the European Central Bank and the Bank of Japan are expected to hold, while markets expect the Bank of Canada and the Reserve Bank of New Zealand to raise rates. The euro drew support from relief that Moody's spared France a downgrade despite social unrest (Reuters). AP said U.S. futures edged higher after Friday's losses on Wall Street, with Alphabet, Microsoft and Amazon reporting this week along with the Fed decision and PCE inflation data. In Seoul, the Kospi fell 1.46% to 5,469.47, its lowest in about seven months, as foreign investors sold a net 695.5 billion won ahead of the FOMC and chip earnings (Asia Today, AP). Collected quotes show the 10-year Treasury yield at 4.988% as of Friday and the VIX at 19.28 (-0.87%) early Monday.

• Indicators to watch · The FOMC statement and any signal on a December hike; Alphabet, Microsoft and Amazon results and AI capex guidance; the PCE print; BOJ and ECB decisions; whether foreign selling in Seoul continues

• B2Brazilian assets slide after the runoffReuters said the result rattled Brazilian markets that had bet on a Bolsonaro win: a Tokyo-listed ETF tracking the Bovespa fell sharply in Asian trading, and the real was expected to weaken sharply against the dollar.

• B2CENTCOM says the main Hormuz lanes are clear of Iranian mines, but shipping remains warySeoul Shinmun reported that after touring the strait by CH-47 on Oct 25, CENTCOM commander Adm. Brad Cooper said the main transit routes 'remain safe without Iranian mines,' while recent reports of tankers damaged by mines and continuing IRGC threats keep the shipping industry on edge.
• C3Houthis claim drone strikes on Saudi oil pumping stations; no Saudi confirmationHouthi spokesman Yahya Saree claimed drone attacks on oil pumping stations on Oct 26, with no confirmation of damage from Saudi authorities (Aaj English TV). Reuters said the Houthis also claimed weekend strikes on Saudi Arabia's East-West crude pipeline.
• B2Taiwan's ITRI plans a 500-ton-a-year rare earths demonstration plantITRI President Chang Pei-zen said on Oct 25 that the separation plant, slated for completion by the end of 2028, could produce 500 tonnes a year (up from 5 tonnes of experimental output) and meet half of Taiwan's needs by the end of 2030; funding still requires a National Science and Technology Council budget (Taipei Times).

Watchlist next 12–48 hours and beyond

• Mon, Oct 26 – Thu, Oct 29
  China's Communist Party fifth plenum in Beijing; any readout from the Saudi-Pakistani-Turkish talks in Tehran
• Tue, Oct 27
  Israel's election and any Iranian or proxy activity around it; whether Houthi attacks on Riyadh continue
• Wed, Oct 28
  FOMC decision; SK Hynix third-quarter results
• Later this week
  ECB and Bank of Japan decisions (holds expected); Bank of Canada and RBNZ decisions (hikes expected); Alphabet, Microsoft and Amazon earnings; PCE inflation
• By Sat, Oct 31
  Whether North Korea starts the loudspeaker broadcasts it promised for October and whether the JCS confirms them; Mirae Asset Life's disclosure of the scope of its leak
• Tue, Nov 3
  U.S. midterms; deadline for the HELIOS call on a U.S. strike on Iranian territory

Edition archiveRSS

• Saturday, Oct 31 · Morning Edition · 05:42 ETAttacks on ships around Hormuz hit a wartime monthly high as Trump says the Iran war will be “wrapped up soon,” Binance finds more entry points behind its $6.3 billion theft, and Seoul weighs stretching its Cheonghae naval unit toward Oman
• Friday, Oct 30 · Evening Edition · 17:44 ETTankers keep getting hit around the Strait of Hormuz as Qatari mediators carry a U.S. letter into Tehran, a tech rout hands the S&P 500 its worst day since June, and the Secret Service joins the hunt for Binance's stolen $6.3 billion
• Friday, Oct 30 · Morning Edition · 05:40 ETA small boat attached explosives to a tanker in the Strait of Hormuz, Binance was hit by a roughly $6.3 billion hack that blockchain analysts tie to North Korea, and AI-spending worries sent South Korea's KOSPI down 3.48%
• Thursday, Oct 29 · Evening Edition · 17:46 ETIran's Revolutionary Guards say three tankers hit mines on Hormuz's southern route and Houthi missiles are downed over Riyadh, as a Russian drone kills at least 14 at a Dnipro rail station and Florida discloses a student-aid breach that may affect 4.9 million people
• Thursday, Oct 29 · Morning Edition · 05:42 ETNorth Korea fires about 10 short-range ballistic missiles six days after Seoul offered military talks, as DHS says it is working to contain a leak of 40,000-plus employee records and Trump says Vance's Iran outreach was about medical aid, not peace talks
• Wednesday, Oct 28 · Evening Edition · 17:40 ETIran dismisses Qatar's draft deal as 'unacceptable ideas' amid reports that U.S. and Israeli officials expect a week of strikes after the midterms if talks fail, while a leak exposes more than 40,000 DHS employees and the Fed holds with two votes for a hike
• Wednesday, Oct 28 · Morning Edition · 05:36 ETThe U.S. has reportedly told Gulf allies to brace for a short, intense Iran campaign after the Nov 3 midterms as oil rebounds, while three South Korean financial firms, including crypto exchange Bithumb, disclose hacks
• Tuesday, Oct 27 · Evening Edition · 17:39 ETA cyberattack forces ambulance diversions at New Mexico's only Level 1 trauma center, the Houthis claim a missile hit on Saudi Arabia's largest refinery, and Iran threatens 'legal action' against every ship run by Sinokor, the biggest crude carrier through Hormuz
• Tuesday, Oct 27 · Morning Edition · 05:44 ETA local truce takes hold in occupied Oleshky even as Russian missiles hit Kyiv's Southern Bridge and a student dorm, the Houthis fire ballistic missiles at Saudi Arabia's Eastern Province hours after the Tehran talks, and CISA confirms PHP2Shell is under attack
• Monday, Oct 26 · Evening Edition · 17:45 ETIran and three Mecca pact powers agree to keep talking after a first four-way meeting in Tehran and oil eases, but the Saudi-led coalition widens strikes on Houthi missile sites and North Korea parks self-propelled guns in plain view of the South
• Monday, Oct 26 · Morning Edition · 05:47 ET · CurrentMediators converge on Tehran and oil eases, but a Houthi missile again targets Riyadh and South Korea reports its first hacking-related customer data leak at an insurer
• Sunday, Oct 25 · Evening Edition · 17:44 ETTrump says it's decision time on Iran, 'finish it off' or make a deal, but rules out a strike Sunday, as the Houthis claim a ballistic-missile barrage on Riyadh's newly reopened airport and CENTCOM's commander says Hormuz shipping lanes are clear of mines
• Sunday, Oct 25 · Morning Edition · 05:50 ETTrump says a U.S. strike on Iran could come 'maybe tomorrow' while floating a 'big, beautiful agreement,' as Houthi missiles and drones fly at Riyadh and Khamis Mushait and Musk says SpaceX throttled Ukraine over 'offensive' Starlink use
• Saturday, Oct 24 · Evening Edition · 17:43 ETA U.S. intelligence memo warns Iranian plots against Americans abroad have reached 'advanced stages' as the State Department thins out Gulf embassies, Houthi ballistic missiles fly at Riyadh, Taif and Yanbu, and Ukraine says its Starlink speed caps are gone