Daily intelligence briefing: 30 July 2026

The United States has taken its turn. United States Central Command struck dozens of Islamic Revolutionary Guard Corps targets across Iran in the early hours of this morning London time, hitting command centres, missile and drone facilities, coastal surveillance and defence sites and maritime capabilities in what it described as a powerful response to Tuesday’s intercepted missile attack on American forces in Jordan, and the President has warned that further blows will follow while leaving the door open to an eventual agreement. Mediators continue working to restore the collapsed framework, and neither side has formally repudiated the Omani channel. In London the heatwave has broken, with the amber heat health alerts lapsing at nine this morning and temperatures easing to 28 degrees today, but the four day Piccadilly line closure begins today and will shape Heathrow movements into the weekend. The digital picture is led by a maximum severity flaw in the Ruflo AI orchestration platform, critical VMware vCenter and Check Point disclosures, and a Firefox flaw that allows a single malicious webpage to compromise the browser, including Tor.

United Kingdom and London

The national terrorism threat level remains at SEVERE, meaning an attack is highly likely. The Metropolitan Police picture over the past 24 hours has been confined to routine casework, with the Clapham murder investigation continuing through the court process, a man charged over a fatal collision in Romford, and appeals issued in Islington and at Alexandra Palace. Nothing in the overnight reporting alters the assessment that the capital is operating in a normal policing posture, though the overnight American strikes on Iran counsel a period of heightened awareness around United States linked premises and interests in London while the escalation runs.

The fourth heatwave of the summer has broken. The amber heat health alerts covering London, the south east, the east of England and the East Midlands lapsed at 9am this morning, London eases to around 28 degrees today under sunny intervals with a chance of showers this evening, and the coming days settle into the mid twenties as cooler air spreads east; the exceptional wildfire risk of midweek recedes accordingly, though grounds discipline on barbecues, machinery and discarded glass remains sensible until meaningful rain arrives. The dominant planning factor is now the railway: the Piccadilly line closure begins today, with no service between Cockfosters and Uxbridge today and tomorrow, the entire line closed during the Friday Night Tube, and no service between Cockfosters and Heathrow across the weekend of 1 and 2 August, including the Saturday Night Tube. Heathrow movements through the weekend should favour the Elizabeth line, the Heathrow Express or road transfers with generous margins. The drought backdrop is unchanged, with hosepipe restrictions still covering more than 20 million customers across England, and the summer peak continues at Heathrow, Gatwick and the Eurostar terminals, where extended check in buffers remain advisable.

Travel corridors

The retaliation came overnight. United States Central Command struck dozens of Islamic Revolutionary Guard Corps targets across Iran between 8pm and 10pm Washington time on Wednesday, the early hours of this morning in London, hitting military command centres, missile and drone facilities, coastal surveillance and defence sites and maritime capabilities in what the command called a powerful response intended to diminish the threat to American forces, commercial shipping and the Gulf states. The strikes followed Tuesday’s intercepted ballistic missile attack on the Muwaffaq Salti air base in Jordan, where five missiles were downed without casualties, and Wednesday’s joint American and Saudi strikes on Iran backed militia positions in eastern Iraq, which killed at least 20 fighters and six Iranian advisers and drew a formal protest from Baghdad over its sovereignty. The President said beforehand that it was America’s turn and that Iran would be hit very hard, while adding that an agreement remains possible at some point, and mediators are still working to restore the collapsed interim framework; the Omani channel has not been formally repudiated by either side. The maritime picture has hardened: the Houthis maintain their declared blockade of Saudi shipping through the Bab al Mandeb after claiming the missile attack on the tanker NCC Ghazal, Red Sea transits are slowing, and damage at the Abqaiq processing facility and a temporary shutdown at the Jazan refinery have fed an oil market that took Brent up more than seven per cent towards 90 dollars. Our advice is unchanged and hardens in tone: all Gulf travel, including Dubai, should remain deferred, principals still in the region should depart early on refundable routings, and the partial carrier restarts of recent days should be treated as reversible at short notice, with regional airspace closures possible without warning while strikes continue.

In Europe, the picture is steady. Paris remains in normal posture, with the standing advice of a low profile near community and faith locations, and a period of the same discipline near American diplomatic and commercial premises across European capitals while the Gulf escalation runs. The Monaco parcel investigation continues along the lines already reported, and parcel and courier discipline holds for principals with commercial exposure to Ukraine or Russia. Geneva and Zurich remain the weakest links in the European corridor, again posting several hundred delayed flights on the worst days this week, and generous airport buffers remain advisable with hold luggage best avoided where practical. New York remains the weakest transatlantic node: nearly 800 flights were cancelled across the three fields on Tuesday, with 339 cancellations at LaGuardia, 304 at Kennedy and 155 at Newark as thunderstorms compounded an approach facility staffed at barely 57 per cent of target, and the Federal Aviation Administration expects the shortfall to persist into next year. The disruption should continue to be treated as structural for the remainder of the summer, and transatlantic movements should carry generous margins and favour morning departures.

Digital and privacy exposure

The patching agenda has a new head item: a maximum severity flaw in the Ruflo AI orchestration platform, CVE-2026-59726, carries a score of 10.0 and allows unauthenticated attackers to run commands and poison the memory of connected AI systems through its Model Context Protocol bridge, and any estate experimenting with AI agent tooling should treat this as an immediate patch to version 3.16.3 or later and as a reminder that agent platforms should never face the internet. Three critical VMware disclosures follow, led by an authentication bypass and a directory traversal flaw in vCenter, CVE-2026-59309 and CVE-2026-59310, both scored 9.8, which family office and corporate IT estates running VMware Cloud Foundation or vSphere should patch without delay. An authentication bypass in Check Point’s SmartConsole management platform, CVE-2026-16232, has public proof of concept code and grants administrative access without credentials, a critical flaw in Ruby on Rails, CVE-2026-66066, allows server files to be read through crafted image uploads, and a Gitea flaw scored 9.8 allows repository writers to plant code that executes on the server. The standing items remain live: the actively exploited VeloCloud Orchestrator flaw at the head of yesterday’s briefing, the SharePoint sequence of patch, remediate and rotate keys, TeamCity and OpenWrt where present, and the Windows proof of concept released after the July Patch Tuesday.

Two items bear directly on households rather than server rooms. A Firefox flaw, CVE-2026-10702, allows a single visit to a malicious webpage to compromise the browser, public exploit code has been released, and the same engine underpins the Tor Browser; Firefox on household and staff devices should be updated to version 151.0.3 or later today, and any family member using Tor for privacy reasons should update before next use. Separately, two compromised packages in the npm registry under the joyfill name were found delivering a remote access trojan at import time, a reminder that development laptops used by family members or staff sit inside the household trust boundary and deserve the same patching and segregation discipline as any other device. The coordinated cyberattack that disrupted more than 30 water systems in Minnesota at the weekend, taking at least one treatment plant offline, is a marker of the broader trend of intrusions against critical infrastructure while the Gulf conflict runs, and argues for checking the resilience basics at principal residences: independent water storage, generator fuel states and tested backup communications. The campaign impersonating Microsoft Teams to deliver remote management tools remains active against office and household staff, and call back verification on any change to payment instructions remains the control that matters most.