What you need to know

Houthi strikes turn Riyadh’s energy showcase into a security test

Houthi attacks on Saudi airports have turned the 25th WPC Energy Congress, held Oct. 11 to 15, from a display of Saudi energy leadership into a test of whether the kingdom can host global business under fire. The strikes hit aviation, not oil, yet still impose real commercial and reputational costs.

Riyadh’s main airport stays shut

King Khalid International Airport in Riyadh remains closed after strikes attributed to Yemen’s Iran-aligned Houthi movement, forcing widespread flight cancellations across the region. Saudi figures put casualties at 13 or more dead and 300 or more injured.

The shutdown is hollowing out the congress, one of the oil industry’s premier gatherings of ministers, executives, and investors.

Investors sell Saudi risk and buy oil

Saudi equities fell modestly while crude rallied, as investors priced supply risk amid the U.S.-Iran confrontation, uncertainty over Strait of Hormuz shipping, and renewed attacks on Gulf infrastructure.

Vision 2030’s business model is exposed

Airport closures raise insurance and logistics costs, disrupt business travel, and slow the movement of energy-sector personnel. That strikes at the core of Vision 2030, which relies on foreign investment, regional headquarters, conferences, tourism, and professional services. Sustained attacks on civilian infrastructure could erode investor confidence and raise the cost of operating in the kingdom.

Gulf markets split by exposure

Regional investors are differentiating between Gulf economies rather than fleeing the region.

Energy sites are the escalation threshold

The Houthis have shown they can impose major commercial costs without touching oil output or export terminals. If strikes persist or shift to energy installations, the hit to oil prices, investor confidence, and Gulf economic activity could be far larger than Monday’s market moves suggest. Riyadh’s task now goes beyond reopening its airport to convincing global companies that the kingdom remains a secure hub for business and energy diplomacy.

Birthplace of civilization

Iran puts Gulf digital infrastructure on its target list

Iranian national security official Mohsen Rezaei explicitly threatened Gulf data centers, AI facilities, and undersea internet cables if major fighting resumes. The threat, issued Oct. 11 to 12, extends Iran’s deterrence posture beyond oil and shipping to the digital assets underpinning Gulf economic diversification.

American-linked tech becomes a named target

Rezaei framed the threats as retaliation for U.S. military and economic pressure, singling out American-linked technology infrastructure in the Gulf. That ties U.S. corporate presence in the region directly to Tehran’s escalation calculus.

Named targets include:

The UAE and Saudi AI bet faces a new risk premium

The UAE and Saudi Arabia have invested heavily to become global AI and cloud-computing hubs, hosting infrastructure used by multinational tech firms and global financial institutions. Credible threats to those facilities and to subsea cables could raise insurance costs, slow foreign investment, and push clients to diversify hosting outside the Gulf.

Resumed fighting is the trigger

The threat is conditional, tied to a return to major hostilities. If fighting restarts, digital infrastructure joins energy and aviation as likely targets, with disruption reaching well beyond the Gulf through global cloud and financial networks.

____________________

Britain blames Iran for a plot against a U.S. bomber base

British Prime Minister Andy Burnham told Parliament yesterday that Iran’s Islamic Revolutionary Guard Corps was almost certainly behind a suspected operation against RAF Fairford in Gloucestershire. The base hosts U.S. strategic bombers flying missions against Iran, making it the first alleged Iranian attempt to strike that campaign on European soil. Iran denies involvement.

A low-cost plot moves a high-value deployment

The probe began after three white vans were spotted near the airfield perimeter on Sept. 27. Police recovered gasoline but no explosives, and the exact nature of the plot, including an alleged drone element, remains disputed.

Even so, the U.S. withdrew its deployed B-1 bombers from Fairford. A small, unproven operation may have helped force the relocation of a key American long-range strike asset.

London escalates diplomatically

Britain moved on Oct. 12 to impose costs and build a multilateral front against Iranian covert activity abroad.

Britain joined 28 other countries in formally condemning suspected Iranian covert operations overseas.

Sabotage threats become a strategic lever

The episode shows that sabotage threats and intelligence warnings alone can reshape U.S. force posture at minimal cost to Iran. Expect tighter security at allied bases hosting U.S. assets, and more pressure on European governments to curb IRGC networks operating on their territory.

It’s the U.S. vs China, everyone needs to pick a side

Washington ties Ukraine aid to sparing Russian refineries

The Trump administration has privately warned Kyiv that further drone strikes on Russian oil refineries could jeopardize U.S. weapons deliveries and intelligence sharing, according to reports published Oct. 12. Washington now treats Ukraine’s campaign against Russian energy as a threat to U.S. economic interests, using Kyiv’s dependence on American capabilities to shape its operations.

The pressure reaches NATO channels

General Alex Grynkewich, commander of U.S. and NATO forces in Europe, was among the officials who conveyed the warnings, according to The Washington Post. Ukrainian officials read them as an implicit threat to intelligence cooperation and to deliveries under NATO’s Prioritized Ukraine Requirements List (PURL), through which European allies buy U.S. weapons for Ukraine.

Oil prices drive U.S. policy

President Donald Trump blames Ukrainian refinery strikes for rising fuel prices, already pushed up by the Iran conflict and Strait of Hormuz disruption, and wants more Russian diesel on world markets. Kyiv sees refineries as legitimate targets because oil revenue funds Russia’s war and refined fuel supplies its army. The result: U.S. price concerns now constrain one of Ukraine’s few tools for imposing economic costs on a larger adversary.

Russia keeps hitting Ukrainian energy despite a ceasefire claim

Trump announced Oct. 11 that both sides had agreed to an immediate energy ceasefire. A day later, Ukrainian President Volodymyr Zelenskyy reported fresh Russian missile and drone strikes on Ukrainian energy sites, causing power outages and civilian casualties. Kyiv denies any functioning bilateral deal, and the Kremlin says only that talks continue.

Speaking at the Warsaw Security Forum, Zelenskyy offered a reciprocal halt on energy strikes but vowed retaliation if Russian attacks persist, putting the onus on Washington to secure Russian compliance. Targets hit included a power plant near Kharkiv and gas production infrastructure.

Ukraine widens its target set to Russia’s digital economy

Reported Ukrainian drone strikes on Yandex data centers have disrupted Russian payment systems and online platforms, including Yandex Pay. The attacks expose how vulnerable civilian computing infrastructure is in wartime.

Claims that the strikes destroyed Russia’s main AI supercomputers or crippled Kremlin disinformation remain unverified.

Some reported drops in Russian automated traffic reflect legitimate Yandex web crawlers, not state propaganda networks.

Moscow offers a one-day truce for elections

Kremlin spokesman Dmitry Peskov said Russian President Vladimir Putin would halt strikes on the day of a Ukrainian presidential election but rejected Zelenskyy’s request for a 60-day ceasefire to hold a safe vote. Peskov accused Kyiv of seeking time to rebuild its forces. The offer comes as Trump publicly criticizes Zelenskyy and suggests Ukraine needs a new president.

Kyiv faces restraint without reciprocity

The likeliest path is continued Russian strikes on Ukrainian infrastructure while Washington presses Kyiv to hold back. If U.S. aid becomes formally conditioned on refinery restraint, Ukraine loses a key economic lever against Moscow, and the rift between Washington and Kyiv over the war’s conduct continues.

____________________

EU hits Russia’s arms supply chain with its largest-ever listing

EU foreign ministers on Oct. 12 sanctioned 1,569 companies and executives tied to Russia’s military-industrial complex, the bloc’s largest single listing to date. The package targets the supply chains behind Russian ballistic missiles, drones, and military aircraft rather than the broader economy.

Weapons inputs are the target

The listing covers 826 Russian companies and 743 executives that produce or supply critical weapons components. These firms employ more than 250,000 people and earn at least €20 billion (about $23 billion) a year.

Targeted sectors include:

Penalties include asset freezes, a ban on EU funding to listed entities, and travel bans on designated executives. Total listings under the EU’s Ukraine territorial-integrity regime now reach about 4,600.

Brussels and Washington pull in opposite directions

The EU is tightening pressure on Russia’s defense industry while the U.S. explores easing restrictions on Russian diesel amid a global energy shortage. European officials worry that U.S. energy concessions could erode Western economic leverage while Russia’s offensive in Ukraine continues.

A transatlantic sanctions gap is the main risk

Expect the split to widen if energy prices stay high. EU measures can choke Russian weapons inputs, but U.S. relief on fuel exports would offset part of that pressure with new revenue for Moscow.

Hackers turn supermarket fridges into a physical weapon

A coordinated cyberattack on supermarket refrigeration systems across France has caused real physical damage, marking a shift from data theft to sabotage of everyday commercial equipment. The attackers needed no access to a power grid, plant, or military site, only internet-connected controllers maintained by outside contractors.

Separately, Japan’s ruling party warns that the country’s cyberspace is “in a state of emergency.”

No link between the two has been established, though they both indicate the risk presented by our reliance on weakly protected, highly networked systems, for every day life.

Attackers engineered maximum damage

Hackers forced fridges and freezers into defrost cycles, pushing temperatures to about 50°C (122°F) and, in one store, 80°C (176°F). They stretched defrost cycles from about one hour to eight, delaying alarms and compounding losses. The Paris prosecutor has confirmed a large-scale attack, and the government has tasked national cyber agency ANSSI with investigating.

A common supplier’s flaw exposes thousands of sites

Investigators are focusing on controllers made by Danish firm Danfoss. Claroty researchers previously disclosed flaws in Danfoss AK-SM 800A controllers allowing unauthorized access and remote commands, and thousands of Danfoss devices sit exposed on the public internet. Danfoss says many compromised units were obsolete and no longer received security updates.

Whether attackers used those flaws or compromised maintenance-contractor access remains unconfirmed. Either way, one vendor’s weakness can expose hundreds of independent businesses, and firms with strong IT security can still be breached through operational equipment.

Relevant vulnerabilities: CVE-2025-41450 and CVE-2025-41451, already flagged in U.S. advisories.

Europe’s exposure looks wider than just France

Félix Aimé, a cybersecurity analyst at Sekoia, reports impacts in Spain, Portugal, Poland, Germany, and Belgium, and French authorities are coordinating with European counterparts. Ahold Delhaize separately confirmed an incident disrupting distribution centers, websites, apps, and some stores in the Netherlands and Belgium. Nothing yet ties it to the French attacks.

Japan’s breaches outpace its defenses

Masaaki Taira, chairman of the Liberal Democratic Party’s National Cybersecurity Strategy Headquarters, issued the emergency warning Oct. 9 after a run of corporate attacks. It is a political alarm, not a formal declaration triggering emergency powers. Japan’s interconnected supply chains mean one compromised supplier or logistics firm can disrupt many companies.

Japan logged more publicly disclosed incidents in the first nine months of 2026 than in all of 2025, per Trend Micro’s enterprise unit TrendAI.

September: 86 incidents, up about 18% from August and 37% from July.

An active cyber defense framework took effect Oct. 1, requiring electricity, gas, finance, and healthcare operators to report incidents.

Taira is pushing coordination beyond critical infrastructure, since smaller firms can serve as entry points.

Attribution is open, but the template is proven

No credible evidence ties either case to Russia, China, Iran, or another state, and suspects range from criminals to activists to state-aligned groups. The French attack’s scale and timing make coordinated sabotage plausible, though coordination alone does not prove state sponsorship. The larger risk is replication: the same weaknesses, including exposed controllers, outdated firmware, and contractor access, exist worldwide across pharmaceutical cold chains, food distribution, and oil, gas, power, and water systems.

____________________

Islamabad dismantles PTI’s last seat of power

Pakistan’s federal government has suspended the elected Khyber Pakhtunkhwa administration and detained its chief minister and senior opposition leaders. The move strips imprisoned former Prime Minister Imran Khan’s Pakistan Tehreek-e-Insaf (PTI) of the province it has governed since 2013, its only remaining institutional stronghold. Islamabad cites a worsening Islamist insurgency, while PTI calls it a security pretext to overturn an electoral mandate.

President Asif Ali Zardari authorized the emergency on Oct. 11 after a cabinet meeting chaired by Prime Minister Shehbaz Sharif. The crackdown followed collapsed talks over a PTI march on Islamabad demanding Khan’s release and better medical care, originally set for late September and since postponed.

Arrests, troops, and a communications blackout

Minister of State for Interior Talal Chaudhry confirmed that Chief Minister Sohail Afridi and several cabinet members are in “preventive custody.” Officials say detainees facing criminal allegations may be prosecuted, while others will be freed when security allows. Afridi, a tribal-belt figure, had openly challenged military operations in insurgency-hit communities.

Police confirmed eight detentions, including PTI provincial president Junaid Akbar and assembly speaker Babar Saleem Swati. Governor Faisal Karim Kundi of the Pakistan Peoples Party, a Sharif coalition partner, now holds executive power, aided by an 11-member advisory council. The federal parliament assumes the provincial legislature’s functions. The military is authorized to assist civilian authorities, with extra security in 12 districts, mostly former tribal areas on the Afghan border.

In Peshawar, troops deployed, containers blocked roads, and mobile and internet services were cut. Schools and colleges closed in Peshawar, Mardan, Swabi, and Nowshera.

Insurgency data backs the rationale, but not the collusion charge

Militant attacks are rising sharply, driven by Tehrik-e-Taliban Pakistan (TTP), which has escalated since the Afghan Taliban retook Kabul in August 2021. Islamabad says militants use Afghan territory to train and recruit, which Kabul denies.

Information Minister Ataullah Tarar accuses the PTI government of collaborating with terrorist groups, and Interior Minister Mohsin Naqvi claims to hold evidence. None has been made public, and PTI flatly denies the charge.

Pakistan recorded 1,232 militant attacks in the first nine months of 2026, versus 1,066 in all of 2025, per the Pakistan Institute for Conflict and Security Studies.

Most occurred in Khyber Pakhtunkhwa and Balochistan.

The legal basis is contested

The government invoked Articles 232 and 234, covering emergencies beyond provincial control and provinces that cannot be governed constitutionally. It describes a six-month intervention, but governor’s rule requires parliamentary approval and runs in two-month extensions up to six months. In designated security districts, the separation of judicial and executive authority is suspended, letting officials exercise judicial powers.

Both houses of parliament must approve the emergency by Oct. 21, since the provincial assembly did not request it. PTI chairman Gohar Ali Khan plans challenges in court and parliament. PTI asks why the whole province is under emergency when the government identifies the worst threats in a few border districts.

Three risks compound for a nuclear-armed state

Islamabad must now show that direct rule improves security, or face growing scrutiny if violence continues. Detaining PTI’s leadership hands Khan’s still-large base a fresh grievance and raises the odds of mass mobilization. Political conflict inside the province could also disrupt counterterrorism coordination just as relations with Kabul deteriorate amid border clashes and mutual accusations.

Parliament’s Oct. 21 vote is the first test

The government must defend both its security case and its constitutional footing by the deadline. The likeliest path is a prolonged standoff between federal institutions and PTI, with court challenges, renewed protests, and the risk that a temporary emergency hardens into lasting direct rule.

Sign up link: https://www.center-of-gravity.info

Inside Track: https://www.center-of-gravity.info/upgrade