Daily intelligence briefing: 1 September 2026

Tuesday opens with the Hormuz crisis back in a kinetic phase. United States forces struck IRGC launchers on Larak Island on Sunday, the first acknowledged strike on Iranian territory in a month, and Iran answered with missiles and drones against two bases in Jordan and, by its own account, the Al Minhad base in Dubai; the UAE says it intercepted a single drone over its territorial waters and denies that any base was hit. Brent has reversed last week’s easing and trades above 91 dollars this morning, only five commodity vessels transited the strait on Monday, and the Iran and Oman corridor framework remains unsigned with Tehran’s conditions hardened. Our travel test is further from being met than it was on Thursday: all Gulf travel, including Dubai, stays deferred. In London the network returns to normal after a Carnival that produced 560 arrests and one death but markedly less serious violence than in recent years; Parliament sits again today, state schools return tomorrow and the Arriva strike resumes on Friday. The Manchester Airports Group breach, now the subject of an extortion claim, is the week’s principal digital exposure for anyone who has used Stansted or Manchester lounges, Fast Track or parking.

United Kingdom and London

The national terrorism threat level remains at SEVERE, meaning an attack is highly likely. The 60th Notting Hill Carnival closed on Monday evening with some 560 arrests across the two days, 62 weapons seized including a handgun recovered on Monday afternoon, and four knife assaults, none of them life threatening; live facial recognition accounted for more than a hundred of the arrests. A man in his twenties died after entering the canal near Meanwhile Gardens off Kensal Road while being pursued by officers on Monday afternoon, and the Independent Office for Police Conduct is investigating. Commander Claire Smart described the mood as overwhelmingly positive and noted that this is the second consecutive year with a marked reduction in serious violence at the event, a fair reading against the seven or eight stabbings recorded in each of 2022, 2023 and 2024. Elsewhere on the Metropolitan Police newsroom, two further people have been charged with the murder of 17 year old David Wynter at Brent Civic Centre in Wembley, bringing the total charged to three alongside a fourth charged with assisting an offender; four defendants pleaded guilty on Friday to the arson attack on Jewish volunteer ambulances in Golders Green; there is a witness appeal after a fatal collision in Stanmore on Monday; and detectives are appealing for information following a rape in Covent Garden on 22 August. No major incident had been declared in the capital as of this morning. With the holiday season now over, the seasonal advice changes register: the return of family and staff this week is the moment to re-establish routine checks, confirm that any temporary access arrangements granted to contractors or house sitters over the summer have been withdrawn, and review alarm codes and key holdings before the autumn diary fills.

Movement in the capital is the easiest it has been for a fortnight. Carnival area roads in Kensington and Chelsea and Westminster were scheduled to reopen from 6am today as the clean up completes, and the Piccadilly line closure and last week’s strike block are behind us. The Met Office has no warnings in force for the week, though its warnings page carried a notice this morning that the system was experiencing issues; the forecast is dry with sunny spells and a maximum of 20 degrees today, cloudier and windy tomorrow with rain mainly north of Berkshire, dry on Thursday and turning unsettled from Saturday. The Weaver line is closed between Hackney Downs and Enfield Town and Cheshunt after 10.45pm tonight, tomorrow and Thursday, and the weekend brings closures on the District line between Edgware Road and Wimbledon, the Elizabeth line between Paddington and Ealing Broadway until 7.45am on Saturday and Sunday, the Suffragette line between Gospel Oak and Woodgrange Park and the Windrush line between Surrey Quays and Clapham Junction. The Arriva North London strike resumes on Friday the 4th and Saturday the 5th and again on Monday the 7th and Tuesday the 8th, affecting more than 40 routes from the Barking, Edmonton, Enfield, Grays, Palmers Green, Stamford Hill, Tottenham and Wood Green garages, with further blocks on the 18th and 19th and 21st and 22nd of September and four more in October; no national rail or Underground action is scheduled this week. Parliament returns from recess today and sits until the conference recess on 15 September, so Westminster and the Whitehall approaches carry their usual small protest and media presence again. No large scale demonstration in central London has been confirmed for the coming weekend; the next national Palestine march is listed for 10 October, though Defend Our Juries style actions have repeatedly been called at short notice and the Met’s weekend public order notice usually lands on Thursday or Friday. The Crime and Policing Act protest powers in force since June, including mask free zones and conditions based on cumulative disruption, remain the framework. State schools return tomorrow and most independent schools stagger in from Thursday and Friday, so the school run congestion that Carnival and the bank holiday held back arrives in force from midweek, compounding the return of Parliament.

Travel corridors

Hormuz enters day 184 in a markedly worse posture than on Thursday. On Sunday United States Central Command struck two IRGC launchers on Larak Island, describing the action as limited and precise against minelaying forces posing an imminent threat in the strait, the first acknowledged strike on Iranian territory in around a month. The IRGC answered overnight into Monday with a missile and drone operation against the King Hussein and Al Azraq bases in Jordan, of which Jordan reports intercepting eight missiles with no casualties, and claimed a further drone attack on United States forces at the Al Minhad base in Dubai; the UAE Ministry of Defence says its air force intercepted one drone approaching from Iran over its territorial waters, rejected reports of any strike on Al Minhad as false and placed its forces on a high state of readiness, and Saudi Arabia, Turkey and Pakistan announced the activation of their joint defence agreement. In the early hours of this morning the Iranian foreign minister went further, alleging that United States rocket attacks on Kharg and Abu Musa had been launched from UAE territory including Ras Al Khaimah and a location near Dubai, a claim Abu Dhabi had not addressed at the time of writing and which, if pursued, places the Emirates more squarely in Iran’s stated target set. The President has said Washington will hit Iran hard and posted a generated video of Kharg Island; the Pentagon denies any strike there. At sea the week produced three tankers struck by projectiles, on the 24th, the 25th and on Saturday evening 12 nautical miles north of Khasab, and the Joint Maritime Information Center continues to warn of drifting and uncharted mines despite the American claim that international routes are clear. The Iran and Oman corridor framework, a pair of lanes some seven nautical miles wide with inbound traffic routed through Iranian waters, remains unsigned, and Tehran’s security chief has restated that the United States must first end the regional war, lift the blockade of Iranian ports, pay compensation and remove sanctions before any reopening; the President says he has no time schedule for talks, and the Qatari, Omani and Pakistani delegations that visited Tehran last week have produced no announced result. Only five commodity vessels transited on Monday against a ten day average of 14, Brent trades at around 91 dollars and 50 cents this morning, up about 1 per cent after Monday’s rise from 87, and war risk cover is quoted between 3 and 10 per cent of hull value with the Lloyd’s Joint War Committee holding its listing for the whole Gulf. The Treasury sanctions package of 24 August, styled Operation Economic Outcast, brought some 60 designations and the suspension of five general licences, with the wind down of General Licence BB ending on 8 September, a date that matters for any counterparty exposure to Iranian linked shipping or payments.

The regulatory and carrier picture shifted at the margins. EASA revised its conflict zone bulletin yesterday: Jordan is removed from the avoidance recommendation, but Gulf waters within the Bahrain, Kuwait, Qatar and UAE flight information regions, the Gulf of Oman west of 58 degrees east and the airspace of Iran, Iraq and Lebanon remain, with the bulletin now valid to 30 September. The Foreign Office advice for the UAE is unchanged since 24 July and does not advise against travel, while the United States raised its posture to reconsider travel on Saturday, citing the ongoing threat of drone and missile attack and Iran’s stated intent to target UAE locations associated with American forces. On the carrier ladder, Air France continues to operate Dubai and Riyadh with Beirut now suspended to 13 September; KLM’s Riyadh, Dammam and Dubai suspensions run to 24 October, as do those of the Lufthansa group including SWISS from Zurich, Wizz Air and ITA; British Airways remains away from Dubai, Tel Aviv, Bahrain and Amman until 25 October; Singapore Airlines is suspended to 24 October and Cathay Pacific to the 25th and 26th; Finnair runs to late March 2027 and Air Canada to mid January; Air Astana, which we had expected to return yesterday, has in fact extended its suspension to 30 September; Turkish Airlines continues to operate Dubai and Abu Dhabi. Emirates is flying with selective cancellations on its Gulf shuttles, with a Kuwait rotation now appearing in the schedule, flydubai is advising passengers to allow at least four hours before departure, and Dubai Airports reported first half traffic down 31 per cent on the year with a stronger second half promised. No incident in Dubai itself has been confirmed since Thursday; a social media claim on Monday of an elevated threat level and shelter in place advice has no official corroboration and should be treated as rumour. Heat remains extreme at 43 degrees with fog possible on the coast overnight. Air France’s loads do not change the arithmetic: the pattern across carriers has not stabilised and the kinetic picture has deteriorated. Our travel test remains unmet: all Gulf travel, including Dubai, stays deferred.

Monaco’s film closures concluded on Friday and the Vuelta has long since crossed into Spain, but preparation for the Monaco Yacht Show of 23 to 26 September began around Port Hercule on Saturday, with the Route de la Piscine fully closed from 14 to 30 September and the quayside restored by 8 October; movements around the port will tighten progressively from next week. The perpetrator of the June bombing at a residential entrance in the Principality remains at large, which keeps residential arrival and departure discipline on the agenda. Paris returns to school today, with the Education Ministry still managing the consequences of the July intrusion in which staff data was taken and later posted online; the ministry is warning explicitly of phishing and identity fraud, so families with children in the French system should treat unsolicited school administration contact with care. Nation on the RER A reopened on schedule on Monday and no RER A works continue into September, but Metro line 6 closes entirely on Sundays the 6th and 20th between Etoile and Nation, Volotea cabin crew strike from the 4th to the 6th, hospital staff hold a national mobilisation day on the 8th and the civil service strikes nationally on the 29th. Geneva records no new home jacking or arrest since our last note; the authorities’ attribution of seven cases to gangs from the Marseille region and the planned number plate recognition perimeter around Vandœuvres stand, and the guidance on residential security, staffed arrival and departure windows and social media discipline is unchanged. Zurich’s constraint remains the SWISS suspension to 24 October; the federal vote campaign for 27 September begins now but carries no movement implications. New York is in its heaviest fortnight: the US Open runs at Flushing Meadows to the weekend of the 12th and 13th with daily loading on the Grand Central Parkway, Van Wyck and 7 train, Labor Day falls on Monday the 7th with the worst road windows on Thursday afternoon, Friday from midday and Monday afternoon, and Newark remains capped at 72 movements an hour until 24 October, which makes it the slowest of the three airports to recover from the thunderstorm and staffing disruption that produced 930 cancellations on 8 August; JFK is the better option where a choice exists. Barriers for the General Assembly high level week of 22 to 28 September appear in Midtown East from around 14 September, with the definitive closure map published only days beforehand. On the London side, no airport or Border Force strike is scheduled for September, Gatwick ran with scattered delays on the bank holiday, and for European travel the Entry Exit System has been fully operational since April with biometric queues now routine, while ETIAS has slipped again with 2027 the working assumption pending a revised timetable this month.

Digital and privacy exposure

The Manchester Airports Group breach is the week’s principal exposure and it reaches London through Stansted. The group, which also operates Manchester and East Midlands, discovered the intrusion on Tuesday the 25th and disclosed it on Thursday: some 8.7 million customers are affected and the data taken includes email addresses, telephone numbers, vehicle registrations, postcodes, airport wifi registrations and car parking, lounge and Fast Track booking records. Payment details were not held on the compromised system and the Information Commissioner has been notified. On Monday an extortion group calling itself FulcrumSec claimed responsibility, asserting it holds around 80 gigabytes of booking and travel data and intends to leak it, and the group confirmed that it has received a ransom demand. The significance for principals is not the marketing data but the combination: a vehicle registration, a home postcode and a record of when the car was parked at the airport and for how long is a travel absence and surveillance dataset, and unlike a social media post it cannot be deleted. Anyone in the household or office who has used Stansted or Manchester lounges, Fast Track or parking should expect credible travel themed approaches, including parking refund and lounge booking pretexts, and should verify every such contact out of band. Separately, Apollo Global Management has been added to the list of victims of the group we track as UNC6671, with names, dates of birth, home addresses and social security numbers taken in an intrusion between 6 and 10 July; the infrastructure behind the group’s Falcon brand alone has been mapped at 63 root domains serving lookalike sign in pages against 83 organisations, 40 per cent of them in financial services and nine of them law firms, and the operators continued to register new lures after public disclosure. No arrest has been made. The controls remain as stated: phishing resistant authentication actually enforced, single sign on with session controls, access restricted to managed devices, and callback verification through known channels for every credential and payment instruction.

The Coldcard case produced no new development over the holiday and the guidance is settled: seeds generated on affected firmware between March 2021 and the patch remain compromised whatever firmware is now installed, funds should be moved via a clean device with a small test transaction first, and every unsolicited approach offering recovery is hostile; group litigation in the High Court is being organised for affected holders and laundering of the proceeds has so far been minimal, which preserves tracing prospects. The Iranian cyber question has sharpened with the weekend’s strikes. Press reporting last week, not confirmed by the National Cyber Security Centre, attributed a four day outage at a small United Kingdom generating facility in July to Iranian linked actors, alongside intrusions at a dozen American water utilities; the point is less the size of the target than the fact that a cyber intrusion produced days of physical disruption, and with the kinetic exchange resumed the cheapest form of Iranian retaliation remains in this domain. The FINRA alert to the financial sector and the CISA advisory on industrial control systems remain the standing guidance and no new advisory has been issued since Friday. For those responsible for corporate or family office estates, the Citrix NetScaler flaw tracked as CVE-2026-8452, patched in June as a denial of service issue and since confirmed to allow unauthenticated remote code execution, has been added to the American catalogue of exploited vulnerabilities with the shortest remediation deadline in the batch, and should be treated as urgent. There is no Apple, Android, WhatsApp, Signal or Chrome emergency update this week, which is itself worth stating. Two administrative dates deserve attention: the Companies House identity verification transition ends on 17 November and only 42 per cent of persons with significant control had verified by June, so most family holding structures still have work to do; and the sentencing of six men convicted over the 52 hour abduction and torture of two French cryptocurrency holders in Canning Town is listed for this month, which will return violent theft from digital asset holders to the front pages, with France still running at roughly one such case every three days. The holiday season has ended and with it the peak of real time location signalling, but the MAG data is a reminder that the exposure now lies as much in third party systems as in the family’s own accounts.