A copilot on a Flydubai Boeing 737 MAX 8 allegedly stabbed the captain during a flight from Dubai to Tel Aviv on Wednesday, sending the aircraft into a dive of more than 14,000 feet in under 30 seconds before passengers and off-duty pilots forced their way into the cockpit and brought the plane down safely in Saudi Arabia. The copilot was arrested by Saudi authorities upon landing, and Israeli Prime Minister Benjamin Netanyahu called the incident a “most serious security incident” and praised the passengers who physically subdued the attacker as heroes.

The incident exposed, for the second time in eleven years, the most consequential design assumption in post-9/11 commercial aviation security: every major protection introduced after September 11, 2001 — reinforced cockpit doors, secondary barriers, door-transition protocols — was built to stop an attack coming from outside the cockpit. When both pilots are alone together and one attacks the other, none of those measures applies.

The aircraft was saved not by any aviation safety system but because off-duty Flydubai pilots happened to be traveling as passengers on that specific flight. Had they not been aboard, no trained personnel would have been capable of flying the aircraft after both certificated pilots were incapacitated.

What Happened Aboard FZ1073

Flydubai flight FZ1073 departed Dubai International Airport (DXB) shortly after 11:00 p.m. ET on Tuesday, September 29, bound for Ben Gurion Airport (TLV) in Tel Aviv. The Boeing 737 MAX 8, registration A6-FKF, had been airborne for approximately two and a half hours when flight tracking data first registered an anomaly.

At 1:31 a.m. ET on Wednesday, September 30, the aircraft’s transponder switched to squawk 7700 — the universally recognized code for a general emergency. Seven minutes later, at 1:38 a.m. ET, the code changed to 7500, the code reserved for unlawful interference with an aircraft, commonly understood as a hijacking signal. The aircraft then dropped more than 14,000 feet in less than 30 seconds before partially recovering, based on Flightradar24 data.

The transponder returned to 7700 shortly after. Ground-based Automatic Dependent Surveillance-Broadcast (ADS-B) coverage in the overflown region of northwestern Saudi Arabia is incomplete, and the aircraft dropped off ground-based tracking at 2:11 a.m. ET before satellite ADS-B reacquired it at 2:28 a.m. ET. The plane landed at Prince Sultan bin Abdulaziz International Airport in Tabuk, Saudi Arabia, at approximately 2:45 a.m. ET. Cluster2 Airports, which manages the facility, said its air traffic control center received a distress call from the aircraft at 5:44 a.m. ET (8:44 a.m. local Tabuk time).

Both pilots were taken to hospital with injuries following the landing. All passengers and crew were confirmed safe and accounted for. Flydubai dispatched two replacement aircraft to Tabuk to transport passengers onward to Tel Aviv.

What Passengers Described

Multiple passengers reported screaming, blood, and a terrifying dive that lasted roughly two minutes. One passenger identified as Daniel told Israel’s Channel 12 that he heard what sounded like a fight in the cockpit, saw blood on the floor near the flight deck, and believed he was living through another September 11 attack when the plane entered its dive. “It felt like an eternity,” he said. Passenger Miriam, speaking to Israel’s i24 channel, said passengers who opened the cockpit found blood in the cockpit and described someone who had “tried to murder the pilot and stabbed him with a pocketknife” before the aircraft lost control.

Yasmin Abukasi, whose daughter Miriam was aboard, described a harrowing phone call received from the plane, in which her daughter described passengers rushing toward a man holding a knife who had attacked the pilot, with significant blood visible in the cockpit area.

The aircraft reportedly sustained visible damage: photographs shared on social media and analyzed by Arik Zer, a former Shin Bet head of flight security, appeared to show a section of the vertical stabilizer missing, consistent with stresses caused by the extreme uncontrolled descent. This detail has not been officially confirmed by Flydubai or Saudi aviation authorities.

What Actually Stopped the Aircraft From Crashing

The aircraft was brought under control and successfully landed not by any aviation safety system, but because off-duty Flydubai crew members happened to be traveling as passengers on that specific flight. Flydubai confirmed that “on-duty flydubai crew travelling on the flight” secured the aircraft and executed the diversion. Netanyahu, citing a passenger who broke into the cockpit, said the group “overpowered the pilot who had carried out the stabbing while he was attempting to sabotage the aircraft’s systems.”

This is not a systematic safety outcome. No regulation required qualified pilots to be aboard. Had this flight not happened to carry deadheading crew members with the skill and will to enter the cockpit and take over the controls, the aircraft would have had no trained personnel capable of flying it after both certificated pilots were incapacitated.

The Security Architecture That Cannot Protect Against an Inside Threat

Commercial aviation’s post-9/11 security framework is built on a single foundational assumption: the threat to the cockpit comes from outside it. That assumption drove the entire design of the Reinforced Flight Deck Door (RFDD), mandated by the Federal Aviation Administration for all US commercial aircraft within approximately 19 months of the September 11, 2001 attacks. The hardened door meets stringent intrusion-resistance and ballistic-protection performance standards.

When the threat is a passenger or a ground-based attacker, the RFDD works. The door has three modes — unlocked, normal, and locked — and when set to locked from inside, it cannot be opened from outside for up to five minutes even if the correct override keypad code is entered. That design directly addressed the 9/11 scenario, in which hijackers overcame cockpits by physical force.

The design does nothing when one of the two people already inside the cockpit attacks the other.

This precise gap was documented in 2015, when Germanwings co-pilot Andreas Lubitz locked himself alone in the cockpit of Flight 4U9525 after the captain left for a bathroom break, then deliberately sent the Airbus A320 into a fatal descent into the French Alps, killing all 150 people aboard. The incident prompted the European Aviation Safety Agency to issue a temporary recommendation that airlines ensure at least two qualified persons be in the cockpit at all times. Emirates, Etihad, and Flydubai adopted the two-person rule within days.

But the EASA recommendation was never converted into a binding mandate. By 2016, EASA revised its guidance to allow airlines to make their own risk assessments. In 2017, Germany’s aviation association reversed the two-person rule for its member carriers, and Swiss International Air Lines followed. The US Federal Aviation Administration has long required two qualified persons in the cockpit whenever a pilot leaves the flight deck, and that standard remains in force. But there is no globally binding ICAO mandate, and the patchwork of voluntary adoptions and subsequent reversals means that today, many international carriers operate with no requirement for a second qualified person in the cockpit during a flight.

“Twenty-five years after September 11, protecting the flight deck remains one of ALPA’s highest security priorities,” said Capt. Jason Ambrosi, president of the Air Line Pilots Association, in a statement published just five weeks before the FZ1073 incident. His remarks focused on a separate but related gap: the implementation of secondary flight deck barriers, which the FAA mandated for newly manufactured commercial aircraft delivered after August 25, 2025, under the Saracini Aviation Safety Act. Airlines received additional time for certification and production, and some compliance deadlines extended into 2027. Critically, there is no requirement to retrofit existing aircraft — meaning most jets currently flying do not have secondary barriers.

Secondary barriers, however, address a different vulnerability: they create a protective enclosure near the cockpit door to defend against cabin-side intrusions during the brief window when the cockpit door is open. They provide no protection against one crew member attacking another while the door is closed.

Who Was Involved and What Investigators Are Examining

Flydubai’s public statement described only “an altercation” in the flight deck. Multiple sources cited by Reuters identified three Israeli officials who characterized the incident as a suspected terrorist attack. One of those officials initially named the suspected attacker as an Omani national — a detail that Israeli Transport Minister Miri Regev also referenced when she called for Flydubai flights to Israel to be suspended and asked the Civil Aviation Authority to investigate whether the UAE had violated the bilateral aviation agreement with Israel, which requires pilots flying into Israeli airports to hold passports from countries with which Israel has diplomatic relations (Oman does not have such a relationship with Israel).

However, Flydubai subsequently confirmed that the altercation involved a Ukrainian captain and a Russian copilot — information that, if accurate, does not align with the Omani nationality claim. That discrepancy had not been publicly reconciled by Saudi or Israeli investigators as of the time of publication.

Netanyahu confirmed on Wednesday that Saudi authorities had arrested the copilot accused of the attack and that the copilot was being questioned by Saudi authorities. Formal investigations are expected to involve Saudi Arabian aviation and security authorities as the state of occurrence, the UAE’s General Civil Aviation Authority (GCAA) as the state of the operator, and Israeli security services given the suspected motive and the composition of the passenger manifest — described by Netanyahu as almost all Israeli nationals.

Squawk Codes as Distress Communication Under Attack

The transponder sequence on FZ1073 — 7700 then 7500 then 7700 — reflects the chaotic evolution of the crisis in real time and illustrates how the ICAO-standardized emergency code system functions as a last-resort communication channel when voice contact with air traffic control is not possible or safe.

Squawk 7700 is the general emergency code, activated for any condition requiring immediate ATC assistance: mechanical failure, medical emergency, or structural loss of control. Squawk 7500 is reserved specifically for unlawful interference — the international hijack signal — and its use requires deliberate, precise four-digit transponder entry at a moment when the crew’s situation was clearly chaotic.

The transition from 7700 to 7500 and then back to 7700 tells a specific story: a crew member — presumably the captain, or a survivor of the initial attack — chose to escalate from “general emergency” to “hijack signal” at 1:38 a.m. ET, then reverted to the general emergency code as the immediate threat was physically contained. That seven-minute window between the two codes corresponds closely to the period when the aircraft underwent its most extreme altitude loss.

The ADS-B tracking gap that followed — from 2:11 a.m. ET to 2:28 a.m. ET, when ground-based receivers lost contact and satellite ADS-B eventually reacquired the signal — reflects a real surveillance limitation over portions of northwestern Saudi Arabia and the surrounding region. The aircraft’s critical events were partially invisible to ground-based tracking during the height of the crisis.

Flydubai and the Dubai-Tel Aviv Route

Flydubai is a low-cost carrier wholly owned by the Government of Dubai, established in 2008 and operating primarily from Terminal 2 at Dubai International Airport. It launched passenger service in 2009 and has grown to serve destinations across the Middle East, Africa, Asia, and Europe, operating a fleet consisting primarily of Boeing 737 aircraft, including the 737 MAX series.

The carrier became the first airline to operate direct flights between Dubai and Tel Aviv following the normalization of UAE-Israel relations under the Abraham Accords in 2020. That route remained operational even as many other international airlines suspended service to Israel during regional conflicts in 2023 and afterward, making Flydubai’s Dubai-Tel Aviv service one of the few consistent air connections between Israel and the Gulf. The flight carried a passenger manifest described by Israeli officials as nearly entirely composed of Israeli nationals.

The airline’s sole prior fatal accident occurred in March 2016, when a Boeing 737-800 operating as FZ981 crashed at Rostov-on-Don, Russia, killing all 62 people aboard in an accident attributed to controlled flight into terrain.

What Comes Next

Investigators in Saudi Arabia, the UAE, and Israel face an unusual jurisdictional challenge: the crime scene is an aircraft now in Saudi custody, operated by a UAE carrier, on a flight to Israel, with a passenger manifest of predominantly Israeli nationals, and a suspected attacker whose nationality is disputed between official sources.

Israel’s elections are scheduled for October 27, 2026 — less than four weeks away. Netanyahu’s government, which had warned of imminent enemy attacks publicly the day before the incident ahead of the ballot, is treating the incident with the gravity of a security event rather than an aviation accident. Netanyahu said Wednesday that he had instructed Israel’s security establishment to “prepare for possible additional threats.”

Flydubai’s immediate operations appear unaffected. The airline confirmed that two replacement aircraft had been dispatched to Tabuk and that the incident had “no impact on other scheduled operations.” Israeli Transport Minister Miri Regev’s call for a suspension of Flydubai flights had not resulted in any announced halt as of this publication.

The broader regulatory question — whether this second high-profile demonstration of the internal-crew-threat vulnerability will produce a global mandate where the Germanwings crash produced only a temporary recommendation — is now in the hands of regulators who declined to act definitively the first time.

Frequently Asked Questions

What do squawk codes 7500 and 7700 mean, and why were both transmitted on FZ1073?

Aviation transponders broadcast a four-digit code assigned by air traffic control to identify aircraft on radar. Three of these codes are universally reserved as emergency signals: 7500 indicates unlawful interference (hijacking), 7600 indicates radio failure, and 7700 indicates any general emergency. On FZ1073, the sequence moved from 7700 (general emergency, set first during the initial chaos) to 7500 (deliberately set by a surviving crew member to signal an unlawful interference situation), then reverted to 7700 as the attacker was physically subdued. The transition represents real-time communication under duress using the only channel that required no voice contact with air traffic control.

If reinforced cockpit doors were designed to prevent attacks on the flight deck, how did this happen?

Post-9/11 cockpit security was designed to stop an attack coming from outside the cockpit — from the passenger cabin or from the ground. Reinforced flight deck doors, secondary barriers, and door-transition protocols all address that scenario. They do nothing when both pilots are already inside a closed, locked cockpit and one attacks the other. This is the same structural gap that Germanwings Flight 9525 exposed in 2015, when co-pilot Andreas Lubitz deliberately locked the captain out and crashed the plane. Neither the European Aviation Safety Agency nor ICAO has since enacted a globally binding rule to address this specific vulnerability; EASA’s post-Germanwings recommendation was later relaxed and several carriers reversed the “two-person cockpit” policies they adopted in 2015.

Is the two-person cockpit rule required on international flights?

Not globally. The US Federal Aviation Administration requires at least two qualified people in the cockpit when any pilot leaves the flight deck, and Canada has a similar requirement. The European Aviation Safety Agency issued a temporary recommendation in 2015 that all carriers maintain two people in the cockpit at all times, but it revised that guidance in 2016 to allow carriers to conduct their own risk assessments and decide independently — and several European carriers subsequently dropped the practice. There is no binding ICAO standard requiring the two-person rule on all commercial flights worldwide.

What can passengers realistically do to prepare for a cockpit threat?

Passengers have no meaningful ability to detect or prevent a cockpit attack before it begins — the cockpit is physically separated from the cabin. What FZ1073 demonstrated is that when an attack occurred, passengers and off-duty crew aboard acted decisively: they entered the cockpit and physically subdued the attacker. Flight attendants carry basic safety protocols; airlines in many jurisdictions train cabin crew in threat recognition. The most effective structural response to this type of threat is regulatory: requiring a second qualified person in the cockpit at all times and mandating robust psychological fitness screening for pilots — two measures that remain voluntary or inconsistently enforced across global carriers.