Daily intelligence briefing: 18 August 2026

The hostile Tuesday arrives as forecast. The second Arriva strike block begins this morning and runs to Friday, taking out more than 40 routes across north London, the Piccadilly line is closed between Cockfosters and Uxbridge until Thursday for the new train programme, and The Weeknd returns to Wembley Stadium tonight for the first of his two final nights, all as the yellow heat alert expires at 09:00 this morning with no Met Office warnings behind it. In the Gulf, the sixty day memorandum of understanding expired yesterday without a comprehensive deal, and the shape of what follows emerged within hours: Tehran announced an understanding with Oman on the map of a transit route through the strait, Washington answered with a threat to bomb Oman if it interferes, and a senior Iranian official described a shift from a defensive to a fully offensive posture. Brent has risen for a third consecutive session to about 91.60 dollars. New York clears to a fine, dry week, and on the digital side the UNC6671 picture has hardened, with confirmed attack attempts against four of the largest American investment firms now on the record. Our travel test for the Gulf remains unmet, and all Gulf travel, including Dubai, remains deferred.

United Kingdom and London

The national terrorism threat level remains at SEVERE, meaning an attack is highly likely. The Metropolitan Police newsroom carries two live appeals of direct relevance to this readership. Detectives investigating the fatal shooting in Clapham have named the victim, 25 year old Auguste-Marie Bile-aka Amoa, and renewed their request for information, and the appeal following the death of a woman after a burglary at her home in Finsbury Park remains open. The Finsbury Park case continues to anchor our August advice: a death in the course of a residential burglary, in peak season with families away, is the argument for treating the domestic perimeter as live rather than theoretical until the school term resumes. Elsewhere the force’s claimed record find rate for stop and search, 36 per cent, published yesterday, and the remand of a man charged over a series of fires in Hackney complete a quiet overnight picture, with no new incident reported that alters the assessment.

Movement is today’s story. The second Arriva strike block is now in force and runs until Friday the 21st, removing more than 40 routes served from the Barking, Edmonton, Enfield, Grays, Palmers Green, Stamford Hill, Tottenham and Wood Green garages, including the SL1 and SL2 Superloop services and the N19, N29, N41 and N279 night buses, with a third block to follow from the 25th to the 28th. The Piccadilly line is closed between Cockfosters and Uxbridge until Thursday, with the Metropolitan line running normally between Rayners Lane and Uxbridge. The Weeknd plays Wembley Stadium tonight and tomorrow, doors at 17:00, on stage around 20:10 and out by 22:30, which puts the Metropolitan and Jubilee line crush against the north London bus gaps on both evenings. The yellow heat alert expired at 09:00 this morning and no Met Office warnings are in force. Journeys in north London should be planned around rail rather than bus for the rest of the week, and anything routed near Wembley on either evening should carry generous margins or move before 16:00.

Travel corridors

Hormuz enters day 170 transformed in tone if not in fact. The sixty day memorandum of understanding agreed in June expired yesterday with no comprehensive deal, and each side moved quickly to define what follows. Tehran announced that an understanding has been reached with Oman on the map of a transit route through the strait, with ships entering on a route closer to Iran and exiting through Omani waters, no fees during an interim period and a joint statement to follow, while setting Washington a deadline of a few weeks to implement its side of the June terms. The American response was maximalist: President Trump said he was not interested in extending the interim arrangement, repeated his stated intention to declare the strait a territory of the United States and threatened to bomb Oman if it interferes, while the Treasury’s promised economic isolation package for Iran is expected this week. A senior Iranian official told Reuters that Tehran is shifting from a defensive to a fully offensive posture, and drone attacks on the office of the Kurdistan Region prime minister in Erbil, launched from the border area, added a northern front to the weekend’s violence in southern Lebanon. The commercial picture is unmoved by any of it: transit remains effectively zero against a pre crisis norm of some 73 vessels a day, war risk premiums remain near 30 times pre crisis levels with cover withdrawn by six protection and indemnity clubs, more than 400 vessels are holding position off Gulf berths, and Brent has climbed for a third consecutive session to about 91.60 dollars, its highest of the month. Our test is unchanged and unmet: no verified normalisation of commercial transit has occurred, and all Gulf travel, including Dubai, should remain deferred.

The carrier ladder is unchanged on paper and newly doubtful in practice. Air France remains due back into Riyadh on Friday the 21st, the first of the reversible restorations to fall due, with Dubai and Beirut pencilled for the 25th, and yesterday’s expiry of the memorandum is exactly the kind of development that produces a quiet extension notice; the airline’s stated position is that resumption remains subject to continuous assessment of the security situation. Otherwise the picture holds: Emirates operates its restored single daily Dubai to Bahrain rotation with Kuwait still suspended, Turkish Airlines is flying Abu Dhabi, Dubai, Damascus, Beirut and Amman with Iran routes off, KLM remains away from Riyadh, Dammam and Dubai until 6 September, British Airways from Dubai, Tel Aviv, Bahrain and Amman until 25 October with Jeddah dropped permanently, Lufthansa and SWISS from Dubai until 13 September, which continues to bear on the Zurich corridor, Singapore Airlines and Finnair until 24 October, Cathay Pacific until the 25th and 26th, United until 7 September, Air Astana until the end of August and Air Canada to the middle of January 2027. Specific flights should be confirmed before any movement is built around them, and the Air France Riyadh decision, due within 72 hours, is now the week’s clearest bellwether of carrier confidence.

Paris holds its improved shape: the RER A remains closed between Vincennes and Noisy le Grand until Sunday the 23rd with replacement buses serving the closed stations, the RER D remains interrupted between Gare du Nord and Gare de Lyon, trams T1 and T2 remain interrupted, T2 until the 23rd, and Nation station is closed for renovation until the 30th, with metro lines 1, 2, 6 and 9 the workaround, so transfers remain workable with margins on the eastern axis. Monaco’s Vuelta week is now imminent: the team presentation on Thursday the 20th begins the closures, Stage 1’s individual time trial runs entirely within the Principality on Saturday the 22nd, from Place du Casino past the Fairmont hairpin, along Larvotto and Port Hercule, through Fontvieille to a finish on Boulevard Albert Ier, and Sunday’s ceremonial start leaves from Place du Palais Princier, with bus diversions and street closures from about Thursday and CAM services free on both race days; movements in and out of the Principality from Thursday to Sunday should be planned around the circuit, and anything that must move by road should do so today or tomorrow. Geneva is quiet, with the cantonal property crime figures still the standing frame, and Zurich reports nothing new, its real constraint remaining the SWISS suspension from Dubai. New York’s rain has cleared on schedule: today is mostly sunny at 28 degrees with a light northerly breeze, tomorrow is sunnier still, no advisories are in force, the rip current risk at ocean beaches has lapsed and all three airports are operating normally.

Digital and privacy exposure

The Coldcard theft has entered its consolidation phase. Analysis published around the weekend puts the running total at roughly 1,800 Bitcoin, some 113 to 116 million dollars depending on the count, taken in four waves between 30 July and 6 August, and confirms that theft activity has slowed markedly since. Around 1,530 Bitcoin remains pooled at attacker controlled addresses under continuous public monitoring, with roughly 246 moved so far, about two thirds of it through CoinJoin mixing and the remainder through on chain obfuscation, and Galaxy Research has circulated the attacker addresses to exchanges and law enforcement so that anything reaching a centralised venue can be frozen. Two points matter for this readership. First, multisignature configurations were untouched throughout, which is the strongest available argument for multisig custody of any material holding. Second, a quiet phase in a theft of this scale is when recovery fraud does its work: assets on any affected device should already have moved to a fresh seed generated on patched firmware, ownership of these devices should be treated as a matter of record, and every unsolicited approach concerning these funds, by any channel, should be treated as hostile.

The UNC6671 picture has hardened in the most instructive way possible. Reporting consolidated over the past week confirms that the group, having retired its BlackFile brand, now operates through at least four parallel identities, Redact, Pink, Helix and Falcon, sharing infrastructure and templates, and that its passkey re enrolment lure has been run against four of the largest American investment firms, with attempts against Point72, Millennium, Two Sigma and Citadel on the record; Point72 detected and contained its intrusion and Two Sigma stopped the attack at the portal stage. The method is unchanged and remains most dangerous on mornings like this one, when a call from a spoofed helpdesk number citing an urgent security requirement lands against inboxes full of genuine start of week resets: calls to personal mobile numbers, lookalike single sign on pages harvesting credentials and tokens in real time, then scripted exfiltration from Microsoft 365 and Okta and the deletion of the security alerts that would reveal it. The defences remain structural, phishing resistant authentication genuinely enforced, callback verification through known channels for every credential, code and payment instruction, and access restricted to managed devices, and the hedge fund cases add a sharper point: firms with institutional security teams blocked these attacks at the door, and family offices without them should assume they present a considerably softer surface to the same operators. With families still abroad in peak burglary month, the standing rule against real time holiday posting from any family account continues to apply.