Daily intelligence briefing: 31 July 2026

Iran has promised its answer. The Islamic Revolutionary Guard Corps vowed yesterday to punish the aggressor following Wednesday night’s heavy wave of American strikes, claiming missile attacks that destroyed three F-35 aircraft and killed American personnel, claims Washington has not confirmed, while declaring full control of the Strait of Hormuz. Two tankers turned back from the strait after one caught fire, yet overall tanker traffic has recovered and Brent has eased to around 85 dollars. In London the weekend is shaped by the Piccadilly line closure, which removes the Heathrow branch on Saturday and Sunday, and by protest activity around the Palestine Action court hearings, where dozens were arrested on Thursday. The digital picture rotates towards the household: a Copilot for Word flaw that lets hidden prompts copy themselves between documents, and a North Korean campaign using fake macOS update screens to steal cryptocurrency.

United Kingdom and London

The national terrorism threat level remains at SEVERE, meaning an attack is highly likely. The most significant public order development of the past 24 hours came at Westminster Magistrates’ Court, where the Metropolitan Police arrested dozens of people at a rally in support of Palestine Action on Thursday; expressing support for the proscribed group is an offence under the Terrorism Act, and further arrests around related court hearings are likely. Routine casework otherwise dominates the Met picture: officers seized £4 million in cash and a kilogram of cocaine following a vehicle stop in Catford, three men received combined sentences exceeding 15 years at Kingston Crown Court for a smash and grab robbery at a Richmond jewellery shop, and a man was charged in the Islington murder investigation. The Richmond sentencing is a reminder that jewellery and watch crime remains an organised enterprise in the capital, and the standing advice on discreet carriage of high value items holds. A period of heightened awareness around United States linked premises remains prudent while the Gulf escalation runs.

The weather is set fair. London reaches around 31 degrees today under sunny skies, with patchy rain possible tomorrow and a cooler, cloudier Sunday in the mid to high twenties; the amber heat alerts have lapsed and are not expected to return this weekend. The dominant planning factor remains the railway. The Piccadilly line closure enters its main phase: the entire line is closed during tonight’s Night Tube, and there is no service between Cockfosters and Heathrow on Saturday 1 and Sunday 2 August, including the Saturday Night Tube. Heathrow movements this weekend should favour the Elizabeth line, the Heathrow Express or road transfers with generous margins. The drought backdrop is unchanged, with hosepipe restrictions still covering more than 20 million customers across England, and the summer peak continues at Heathrow, Gatwick and the Eurostar terminals, where extended check in buffers remain advisable.

Travel corridors

Iran’s answer has so far been louder in word than in deed. The Islamic Revolutionary Guard Corps declared on Thursday that it would punish the aggressor that day, and Iranian outlets later claimed missile strikes that destroyed three F-35 aircraft and killed American service personnel; neither the White House nor the Pentagon has confirmed the claims, and no major new American losses have been independently reported. Tehran also stated that a bunker buster strike on Qeshm Island hit two homes and killed a family of three, and explosions were reported across Qeshm and Bushehr province as American operations continued. The Guard has declared full control of the Strait of Hormuz and warned that the waterway cannot be reopened while American threats continue; two tankers turned back after one caught fire, yet overall tanker traffic through the strait has recovered from the recent slowdown, and Brent has eased to around 85 dollars, down about two per cent on the day though still up roughly 19 per cent on the month. Saudi Arabia is organising international coordination to protect shipping lanes and is reported to be negotiating separately with the Houthis, whose declared blockade of the Bab al Mandeb stands, and more than 50,000 American service members remain deployed across the region. Our advice is unchanged: all Gulf travel, including Dubai, should remain deferred, principals still in the region should depart early on refundable routings, and the partial carrier restarts should be treated as reversible at short notice; 13 international carriers have already suspended Dubai services until October while Emirates and Etihad continue to fly, and regional airspace closures remain possible without warning.

In Europe, the picture is steady. Paris remains in normal posture, with the standing advice of a low profile near community and faith locations and near American diplomatic and commercial premises across European capitals while the escalation runs. In Monaco, prosecutors have identified a suspect in the parcel bombing and the manhunt continues across Europe; parcel and courier discipline holds for principals with commercial exposure to Ukraine or Russia. Geneva and Zurich remain the weakest links in the European corridor, with the worst days this week again posting hundreds of delayed flights, and generous airport buffers remain advisable with hold luggage best avoided where practical. New York remains the weakest transatlantic node: around 500 flights were cancelled and more than 4,000 delayed across the three fields in the latest wave of disruption, as thunderstorms compounded the air traffic control staffing shortfall the Federal Aviation Administration expects to persist into next year. The disruption should continue to be treated as structural for the remainder of the summer, and transatlantic movements should carry generous margins and favour morning departures.

Digital and privacy exposure

Two disclosures this week bear directly on family offices and households rather than server rooms. Researchers have shown that Microsoft Copilot for Word can be manipulated by hidden prompts concealed inside documents: the instructions can alter figures in generated summaries and copy themselves into new documents, behaving in effect as a self propagating worm across a document estate. Until Microsoft’s mitigations mature, documents from outside the trust boundary should not be processed with Copilot enabled, AI generated summaries of third party documents should not be relied upon for figures, and family offices should review where Copilot is switched on. Separately, a North Korean campaign is using poisoned advertising and fake macOS update screens, in the style known as ClickFix, to talk users into running commands that install cryptocurrency stealing malware. The rule for household and staff devices is absolute: no legitimate update ever asks the user to paste commands into the Terminal, and Apple devices update only through System Settings.

On the estate side, Microsoft has patched a serious flaw in Azure Cosmos DB, reported as CosmosEscape, which allowed read and write access across customer tenants before the fix; no customer action is required, but estates holding sensitive workloads in Cosmos DB may wish to seek assurance on the exposure window. A Cisco Secure Firewall Management Center flaw, CVE-2026-20316, involves static credentials that permit unauthenticated access to system data and should be patched where the platform is present. The standing agenda otherwise remains as set out yesterday: patch the Ruflo AI orchestration platform to 3.16.3 or later, the vCenter pair scored 9.8, Check Point SmartConsole and Ruby on Rails where present, update Firefox on household devices to 151.0.3 or later, including the Tor Browser, treat the compromised joyfill npm packages as a marker for development laptops inside the household trust boundary, and hold to call back verification on any change to payment instructions.