Good morning. A multiplicity of hoax bomb threats divert passenger flights across Europe. A malign cyber-attack targets supermarket fridges in Belgium, Sweden, the UK and – in a sickening escalation – the cold storage facilities of France’s national blood service.

The actors behind this week of chaos and disruption, be they hostile states or criminal gangs – or even enterprising teenagers – are yet to be identified. But what is certain is that they operate in a context of deepening global conflicts, building national threat and an accompanying, pervasive sense of vulnerability.

Welcome to the grey zone – that ambiguous space between routine peace and conventional military conflict, where proxies duck state accountability and cyber-tactics are developing at an alarming rate.

For today’s newsletter, I spoke to the Guardian’s defence and security editor, Dan Sabbagh, and our global technology team about flights, fridges and why “keep calm and carry on” is more than a tote bag slogan.

But first the headlines.

Five big stories

1. UK news | Russell Brand has been found guilty of raping a woman and sexually assaulting three others over the course of five years of his show business career.

2. US politics | Donald Trump signed a proclamation that he says will prevent future administrations from changing his design of the Oval Office and Cabinet Room, spaces he declared as national monuments that should be preserved.

3. UK politics | Andy Burnham has said he wants to “recast” the UK’s deal to cede control of the Chagos Islands after resistance from Washington.

4. Health | Cancer diagnoses in England have hit record highs, with more than 1,000 people a day diagnosed, NHS figures show.

5. World news | The UN-recognised government of Yemen has shaken up its political and military leadership in an attempt to regain territory lost to the Houthis in September.

In depth: ‘Terrorism doesn’t have to be violent. The purpose is to scare’

Hoax bomb threats disrupted at least 25 different commercial flights across Europe yesterday, with some forced to make emergency landings, and after similar threats on Tuesday, when seven planes were searched or diverted after malicious alerts.

There is, at least so for, no suggestion of orchestration by a hostile terror group or state actor according to investigators, although investigations continue. It’s perfectly possible that this could be the work of some lone disruptors, says Dan, who reminds me that “airlines receive bomb threats on a daily basis, at a rate that we would find extraordinary if we knew”. Nonetheless, the fact that these airlines are treating these threats as credible suggests a potential level of coordination, aviation experts told the Guardian on Thursday.

These threats take place with aviation security under sharper scrutiny after the flydubai incident, when a pilot fought off his knife-wielding colleague in an apparent attempt to crash a full passenger flight heading for Tel Aviv.

But beyond that “jittery background noise”, is a significant step-change in the manner of threat we face. Twenty-five years on from the inception of the War on Terror, when Islamist terrorism has receded relative to the hostile state threats, “we’re living in a different world with familiar uncertainties, but attributed to different players,” Dan tells me.

Conflicts in Ukraine and the Middle East are reverberating closer to home. Since 2022, we’ve witnessed intensifying acts of sabotage on European states that are believed to trace back to Russia but deliberately fall below the threshold for military response – a so-called hybrid or “shadow war” with the singular purpose of disrupting support for Ukraine. Only two months ago, an alleged attack plot on RAF Fairford was organised by a handler police believe was working on behalf of Iran.

Meanwhile, tech expert Azeem Azhar warned recently that the internet is experiencing it’s own Wuhan moment, as AI enables bad actors to hunt for system flaws and spread them, mirroring the early days of the Covid pandemic.

“Terrorism doesn’t have to be violent to terrorise,” says Dan. “The purpose of terrorism is to scare.”

What about other targets?

Ratcheting up disruption, and the accompanying psychological hit, is precisely what we’ve seen elsewhere this week. Supermarket fridges and freezers in seven European countries malfunctioned earlier this week, their thermostats remotely cranked up in some cases to 50C, in what some fear indicates a new front in hacking tactics.

Similar incidents have been reported in the UK, and I spoke to our global technology editor Dan Milmo on his way back from interviewing a fruit and veg wholesaler based near Heathrow, whose fridges went on the blink on Monday. The experience has prompted him to add some tinned goods to his weekend shopping list.

“There are only ever two likely candidates for a hack,” Dan tells me. “Criminal gangs or nation states.” He adds an emerging tertiary category of “troublesome teenagers”, such as the loose collective of English-speaking hackers Scattered Spider, two of whom were jailed in July for their attack on Transport for London.

One cybersecurity researcher told Dan that attacks on dummy Danfoss fridge controls – one of the software systems also targeted by the hackers in mainland Europe – had “all the hallmarks” of operations linked to Russia.

What are security services doing about these threats?

“There is a very real and intense cyberwar going on out there,” Dan Sabbagh tells me, and security agencies in the UK have viewed technological resilience as a key part of their responsibility for a number of years. The Turing Institute, for example, is looking at ways to utilise AI to make critical infrastructure systems more secure.

The police and security services are monitoring for threats all the time – MI5 has about 3,000 active subjects of interest currently – arranged in a hierarchy, with an understandable focus on the more serious ones, including threats to life. But lower level activity that is not obviously threatening, whether that’s online activity or buying paint with the intention of daubing racist graffiti, can be harder to pick up. As with other public services, this is a resourcing question as much as anything else.

Is chaos easier to generate in our interconnected world?

I put this to our global technology reporter Aisha Down, who explains that many hacks happen though edge devices – networked items that are connected to the internet but don’t have processing power and so aren’t the main focus of security upgrades by a company or household.

Famously, in 2016, North Korea came within a few keystrokes of pulling off a billion-dollar heist by hacking the Bank of Bangladesh via an unsecured printer.

Aisha is keen to dial down the panic. The point about cyber-attacks is that every single one is opportunistic: a hacker has to find a vulnerability and then discover a way to exploit it. “Just like a burglary, you might get into the room where all the jewellery is stored,” she says, “but the damage you can do is not a given.”

There is, however, a steady escalation in this type of threat. Aisha gives the example of Finland which, given its proximity to Russia, is watching cyber-tactics very closely. “What people report to their national cybersecurity centre is growing, from 18,000 reports last year for a population of 6 million people, to 21,000 this year.” This can be partly traced back to a developing criminal hacking ecosystem, some with loose links to the Russian state.

Do we need to buy more beans?

While a key element of a cyber-attack is the psychological impact, that can be hard to square with the UK government’s own Be Ready initiative, which advises us to off-set threats of hybrid warfare and hostile state sabotage by stockpiling 72 hours’ worth of emergency supplies – including water, beans and Twiglets (if you’re Andy Burnham). Indeed, governments across Europe are advising citizens to build up non-perishable larders.

It’s perhaps useful to balance the likelihood of a cyber-attack with the potential scope, suggests Aisha, who confesses she’s too busy sourcing furniture for her new flat to think about tinned goods.

One European cybersecurity official told Aisha recently that there’s a vulnerability in every 1,500 lines of code, on average.

“Their view is: it’s going to happen. It’s going to be opportunistic. But, unlike bombing a power station in the dead of winter, you won’t be offline for months.”

With that perspective, keeping a bunch of tenners handy to see you through a few days of disruption makes sense.

As for stockpiling food and water, Dan is still debating with his partner just how necessary those extra tins of peas really are. “If you’re a government wanting to spend £10bn more on defence by the end of the decade, it’s useful to have that message about keeping a few bottles of water at home,” he says.

To be clear: it’s not Dan’s intention to dismiss stockpiling advice as a purely cynical exercise. The developing threats are all too real. But as he puts it: “If the purpose of terrorism is to generate fear, the first thing you should do is not panic and keep calm.”

What else we’ve been reading

• We got movies that inspired GTA before GTA VI – a joke that will (hopefully) soon be gone. Anyway, it was fun reading how huge classics influenced the making of the most iconic game. Lysia Wright, newsletters team

• In AD43, Roman emperor Claudius invaded Kent, after being persuaded by a British “king”. Now, an archaeologist claims the British ruler was a queen. If the Roman empire is your bag, Nicola Davis’s article on the controversy is a thought-provoking read. Micha Frazer-Carroll, newsletters team

• Christmas decorations are adorable, but they definitely create a lot of waste. I enjoyed reading the best reusable Christmas things. Lysia

• Parts of Erin Somers’ piece on lab-grown meat made me salivate, others made me nauseous. I was entirely immersed in her quest to find out why it never really took off. Micha

• If I wrote a masterpiece during the Enlightenment I too would probably believe I was mythical. I hadn’t heard of Jan Potocki or his werewolf ways before reading Tobias Grey’s article. Lysia

Sport

Football | Sunderland’s unbeaten run in the Europa League came to an end as they were beaten 2-0 by Dinamo Zagreb at the Stadium of Light, while Celtic got off the mark in a 3-2 victory over Besiktas.

Rugby union | Tom Curry has emerged as a major doubt for England’s autumn opener against Australia on Sunday, handing Steve Borthwick a huge blow before a crucial November campaign.

Football | Cristiano Ronaldo has announced that he will not play for Portugal any more, ending an international career that spanned six World Cups and included a European title and the men’s all-time scoring record.

Something for the weekend

Our critics’ roundup of the best things to watch, read, play and listen to right now

Art and design

Constantinople to Istanbul (V&A, London) | ★★★★★

With tiled portraits and handmade robes, Victoria and Albert’s new exhibition showcases the colours of the Ottoman and Byzantine Empires. Read Jonathan Jones’s full review.

Film

I Play Rocky (in cinemas now)
| ★★★★☆

Sylvester Stallone stars as himself in his latest film. A struggling American-Italian desperate to get his screenplay “Rocky” out there. Read Peter Bradshaw’s full review.

TV

Black Doves (Netflix) | ★★★★
☆

Keira Knightely returns to our screens as Helen Webb, an undercover spy and protagonist of Netflix drama Black Doves. Alongside her espionage work, she certainly keeps busy as a mother, wife to the prime minister and best friend to a hitman. Read Rachel Aroesti’s full review.

Game

The Legend of Zelda: Ocarina of Time | ★★★★★


After changing a generation of gamers and their childhoods, The legend of Zelda lives on. Yesterday, Link came back to Nintendo screens, just in better definition and with fully voiced cutscenes. Read Keza MacDonald’s full review.

The front pages

“Brand faces ‘significant’ prison term for rape and sexual assault”, is the Guardian’s front page today. The Times writes “Brand found guilty of rape”, the Telegraph says “BBC ‘enabled’ rapist Brand”, the Sun has “Rapist”, and the Mirror’s take is “Justice”. On the same story, the Mail splashes “Downfall of the swaggering sex predator fawned over by the Left”, and Metro has “Rapist Brand caged”.

Elsewhere, the i Paper leads on “Godfather of AI warns humanity: it’s all hurtling out of control”, and the FT has “Tech stocks plunge as investors worry blue wave will sink AI spending boom”.

The Latest

Will the UK finally pay slavery reparations?

Andy Burnham has asked countries affected by Britain’s role in slavery to help shape a formal apology through a ‘structured dialogue’. During the prime minister’s visit to the Commonwealth heads of government meeting in Antigua and Barbuda, Downing Street said affected countries would play an indispensable role in crafting an enduring message. Though the plans for talks were received positively, the British government is still ruling out the idea of paying reparations, which for decades campaigners have been calling for. Lucy Hough speaks to the Guardian’s Caribbean correspondent, Natricia Duncan.

Cartoon of the day | Ben Jennings

The Upside

A bit of good news to remind you that the world’s not all bad

On 25 October, as Brazil held its presidential election, 101-year-old Celia de Oliveira Soares left home for the first time in months, to vote for the first time in nearly a decade. She was determined that Luiz Inácio Lula da Silva (known as Lula) – who had lost in the first round – should beat the far-right candidate Flávio Bolsonaro.

Since Brazil’s return to democracy in the 1980s, no first-round loser has ever bounced back. But 3 million extra voters took part in the second round, after skipping the first – and 1.4 million of them were over 70 years old. The victorious Lula, along with many others, is now hailing elderly voters as the election’s heroes.

“It is possible to resist fascism – all you need to do is mobilise society,” the former minister Simone Tebet said. “Young people hit the streets and golden-agers saved our democracy.”

Sign up here for a weekly roundup of The Upside, sent to you every Sunday

Bored at work?

And finally, the Guardian’s puzzles are here to keep you entertained throughout the day. Until tomorrow.

Bomb threats have caused diversions and emergency landings for at least 15 flights across Europe, renewing questions about a possibly coordinated effort to disrupt travel.

The series of warnings on Thursday morning affected flights between Italy, Ireland, the UK, Spain, Bulgaria, Romania, Poland, Finland, Austria, Denmark, Belgium, Portugal, Greece and Czechia.

On Tuesday seven planes across Europe were searched or diverted after malicious hoax bomb alerts. On Monday a flight from the UK to Bulgaria was diverted after a threat that was apparently without substance.

The latest alerts affected flights by Ryanair, Aer Lingus, Wizz Air, Finnair and LOT. All landed safely. Initial searches of some of the planes found nothing suspicious.

Two Ryanair flights from Copenhagen and Madrid to Sofia made emergency landings in the Bulgarian capital while a Ryanair flight from London to Sofia was diverted and landed at Plovdiv, Bulgaria’s second largest city.

A Bulgarian government spokesperson said: “Upon landing, the necessary inspections were carried out in accordance with the applicable procedures and no issues were identified. Airport operations at both Sofia airport and Plovdiv airport have returned to normal.”

An Aer Lingus flight from Dublin to Rome was diverted to the Évreux-Fauville military airbase in northern France. A Wizz Air flight from Milan to Warsaw was diverted to Vienna, while a Ryanair flight from Porto and an Aegean Airlines flight from Thessaloniki, both to Milan, were searched upon arrival at Milan’s Malpensa airport.

Also affected were an LOT Polish Airlines flight from Warsaw to Brussels, two Finnair flights from Helsinki to Rome and Vienna and four flights by other airlines to Prague.

A Czech police spokesperson said: “Security measures at Prague airport have just ended, with pyrotechnic inspections yielding negative results.”

The threats against the Finnair flights were “unfounded or hoax”, said an airline representative. “Unfortunately, air traffic is sometimes subject to threats, as we have seen this week, when also other airlines in Europe have faced hoax bomb threats. Threats are almost always unfounded.”

The travel disruption followed cyber-attacks this week against supermarket refrigeration systems. Some analysts speculate the disruption, along with drone incursions and triggering of app alerts, is part of a hybrid campaign to unsettle Europe on behalf of Iran, Russia or other state actors.

A Kremlin spokesperson said on Thursday it was “absurd” to blame Vladimir Putin’s administration for the hackers who targeted fridges. “We have ​such baseless accusations against our country, implicating it in everything,” Dmitry Peskov told reporters.

Many of the affected flights on Thursday were operated by low-cost carriers but there was little discernible pattern surrounding the incidents.

The Italian news agency Ansa, citing police sources, said the warning for the Helsinki-Rome and Dublin-Rome flights came from an anonymous email written in Italian and sent to the Rome airport company, ADR, and other affiliated companies. The subject heading was “segnalazione minaccia” (“threat warning”).

Aviation experts say fake threats occur daily but that such a number of credible threats, even if malicious hoaxes, appears to point to coordinated action.

Capt Martin Drake, a former airline pilot and technical adviser to the Balpa union, said airlines had security teams who assessed each threat on a traffic-light scale: green to keep going or red to be grounded, with an amber option only for flights yet to take off, allowing tighter checks and searches of the plane before clearing it to fly.

“If you want to deliberately disrupt a flight, then you need to do so once it’s airborne,” said Drake. Pilots have a QRH – a quick response handbook – whose instructions will probably include to descend quickly as well as divert to the nearest airport on receipt of a red alert. At cruising altitude, “aircraft pressurisation would do a lot of the work of any improvised explosive device”.

Diversions are expensive as well as highly disruptive, but airlines have little choice in the face of any remotely credible threat.

The ready availability of airline operations information on the internet means that any hoaxer now has a level of detail about the schedules, the type of plane and its technical specifications that would have eluded all but insiders decades ago.

Rhys Jones, an analyst at Osprey Flight Solutions, an aviation intelligence firm, said the confidence of airlines in European airport security should not mean any change to normal protocols after the hoaxes, but “one of the natural responses will be to see double-downed security, media coverage and public concern about travelling”.

He said the threats seemed linked but “a reasonably chaotic campaign with no particular region targeted”, and while they could weaken future security responses through the normalisation of threats, simply creating disruption could be regarded as a success by those carrying out the hoaxes.

Ministers are seeking to end the “wild west” of parked e-bikes blocking pavements, as they attempt to crack down on antisocial behaviour such as cyclists jumping red lights.

The consultation, led by the Department for Transport, will aim to establish national standards on issues including parking, ending the current patchwork of agreements between individual bike companies and councils.

While some areas enforce rules that mean shared bikes – such as those operated by Lime, Forest and Voi – can only be left in designated parking bays, elsewhere the rules are looser, prompting complaints about bikes blocking pavements, particularly for wheelchair users, people with pushchairs and those with impaired vision.

It will also look at antisocial and illegal riding, for example, people jumping lights or the use of bikes by those who are underage or drunk.

The plans will also examine guidelines for fleet sizes to ensure certain areas are not overcrowded and possible requirements for operators to have insurance, so someone hit by a rider on a hired e-bike can claim compensation.

Another part of the consultation will look at whether councils and mayors should be given powers over the fees charged to rent bikes, and whether companies should share data to improve enforcement and transport planning.

Since arriving in the UK in 2018, shared e-bike systems, of which Lime is by some way the biggest, have expanded rapidly, especially in London. More than 2.6 million Britons used an e-bike share scheme in the year to September 2025, according to one estimate.

There is evidence that shared e-bikes are used by a broader demographic range of riders than traditional bikes, in part because of the electric assistance, but also because they do not require somewhere secure to park.

The DfT argues that the bikes are growing in importance for urban transport, but that the lack of any central oversight has created difficulties, noting that the companies themselves have called for more regulation.

The proposed changes would be “a small but important everyday fix to make our streets safer”, Andy Burnham said. The prime minister added: “E-bikes can make getting around that bit easier, but when they block pavements or are used irresponsibly they can be a real frustration.

“I want to sort that by giving communities more control over where they are parked and making sure companies and riders play by the rules.”

Heidi Alexander, the transport secretary, said: “Shared e-bike schemes have revolutionised the way people travel around our towns and cities. They are easy to use, get us active and help reduce emissions, but we need to make sure they work with the communities where they operate.

“That’s why we are taking decisive action to give local leaders the power to stop nuisance parking, tackle antisocial behaviour and make journeys safer.”

There are parallel efforts in London under which the DfT would devolve power to the mayor, Sadiq Khan, and Transport for London to unify e-bike regulations, which are currently the responsibility of individual boroughs and vary significantly.

Khan said: “The ‘wild west’ approach to dockless e-bikes cannot continue. While these services are helping thousands more Londoners to cycle, their rapid growth has also brought challenges around safety, inconsiderate parking and the lack of data needed to properly manage them.

“I’ve been calling for powers to better manage dockless e-bike schemes since 2017, when the first schemes arrived in London, so I welcome the government’s plans to give cities the powers they need to do this.”