One at the theatre attack, another at the stadium attack.
The Guardian is live-blogging the investigation, here, but won't definitely say they were Syrians until the fingerprints are linked to the passports.
Gee, suicide bombers blow themselves up and they just happen to find Syrian passports on the bodies/nearby, but the bombers could have stolen/forged them.
Wouldn't want to accuse Syrians falsely now would we?