Daily intelligence briefing: 2 August 2026

The weekend opens under the shadow of an American threat that has not yet been carried out. Washington is reported to have ordered fresh strikes on Iranian energy infrastructure as early as this weekend, with refineries and power plants among the targets under consideration, yet as this briefing is compiled no such strikes are confirmed. Saturday instead brought two further tanker incidents off Oman and the interception by Kuwaiti air defences of Iranian drones targeting vital facilities. Transits of the Strait of Hormuz have fallen as low as five vessels in a day and Brent settled the week at 87 dollars and 93 cents, up almost 23 per cent for July, with markets reopening on Monday. The State Department has advised Americans across the region to consider departing. In London the Piccadilly line closure enters its final day under sunny skies of around 28 degrees, with normal service expected from Monday. The digital picture is led by a hardware wallet flaw that allowed thieves to drain more than 70 million dollars of Bitcoin in 41 minutes, and by a Russian campaign that hijacks hotel Wi Fi sign in pages to plant surveillance malware on travellers’ devices.

United Kingdom and London

The national terrorism threat level remains at SEVERE, meaning an attack is highly likely. The Metropolitan Police newsroom has been quiet into the weekend, with no new items since Friday brought charges over multiple assaults on prison staff at HMP Belmarsh and the arrest in Cyprus in the first overseas investigation under the National Security Act. The picture around Palestine Action continues to settle: campaigners claim 152 people were arrested at Thursday’s gathering outside Westminster Magistrates’ Court, while reporting attributes a figure of 117 to the Metropolitan Police, and no further events have been announced for this weekend. With plea hearings continuing and the Supreme Court reviewing the proscription, any assembly linked to the group is still best given a wide berth, and expressing support for it remains an offence under the Terrorism Act. A period of heightened awareness around United States linked premises remains prudent while the Gulf escalation runs.

The weather is warm and settled, with London reaching around 28 degrees under sunny skies, no rain expected and no heat alerts in force. Today is the final day of the Piccadilly line closure: there is no service between Cockfosters and Heathrow, the whole line closes during the overnight hours, and Finsbury Park station remains shut, with normal service expected across the line from Monday morning and Barons Court remaining closed until November. Today also brings the DLR closure between Tower Gateway and Shadwell, gaps on the Lioness line before noon and after half past eight this evening, no Windrush line service between Clapham Junction and Wandsworth Road, and no Mildmay line trains between Camden Road and Stratford after a quarter past ten tonight. Southern services between Shepherds Bush and Watford Junction do not resume until midday and stop again after nine this evening. Heathrow movements should continue to favour the Elizabeth line, the Heathrow Express or road transfers with generous margins. The drought backdrop has hardened: the Environment Agency declared drought across seven regions of England on Wednesday, and eight hosepipe bans are now in force, including Thames Water’s covering London and the Thames Valley.

Travel corridors

The question hanging over the weekend is whether Washington carries out its threatened strikes on Iranian energy infrastructure. American reporting says fresh strikes have been ordered for as early as this weekend, and Iran has warned against igniting what it calls the flames of war; no such strikes are confirmed as this briefing is compiled. The maritime pressure has not eased. The United Kingdom Maritime Trade Operations agency reported two incidents off Oman on Saturday, a tanker struck by an unidentified projectile that left its engine room damaged and the vessel unable to manoeuvre, and a reported explosion in the water near Khasab, while Kuwaiti air defences intercepted Iranian drones targeting what officials described as vital facilities, with material damage from falling debris but no casualties. Transit data remain dire, with as few as five vessels moving through the strait on the worst day this week, though two loaded supertankers did exit on Friday. Brent settled the week at 87 dollars and 93 cents, up almost 23 per cent for July, and Monday’s open will trade whatever the next 24 hours bring. The State Department issued coordinated security alerts across its Middle East posts on Saturday advising Americans in the region to consider departing or be prepared to depart, and the American consulate in Dubai remains on ordered departure status. The diplomatic track is not dead: Iran’s chief negotiator has signalled interest in converting the military position into diplomacy, mediated exchanges continue on procedures for reopening the strait, talks on the Lebanon file convene in Rome on Tuesday, and the Gaza disarmament road map has firmed into a fifteen point plan with a weapons inventory due within a fortnight, though Israel has not publicly accepted it. The Saudi maritime coalition announced in Riyadh now stands at 14 founding nations with 43 countries attending, and the Houthi leadership has answered it with a threat of full escalation.

Our travel advice is unchanged: all Gulf travel, including Dubai, should remain deferred, principals still in the region should depart early on refundable routings, and any carrier restart should be treated as reversible at short notice. Dubai International remains open with a three hour check in recommendation, and Emirates and flydubai are broadly holding their schedules, but Emirates cancelled its Kuwait, Bahrain and Amman rotations on Saturday with further cancellations expected today, Etihad and Air Arabia continue to trim Gulf services, and Qatar Airways has extended its suspension of flights to Bahrain, Erbil and Kuwait until 7 August. The longer suspensions hold, with British Airways away from Dubai until the end of October and Lufthansa and SWISS until 13 September, which bears directly on the Zurich corridor. The Foreign, Commonwealth and Development Office still does not advise against travel to the United Arab Emirates but continues to warn that airports and airspace can close at short notice. In Europe the picture is steady: Paris remains in normal posture, the Monaco parcel bombing investigation reports no fresh developments, and Geneva and Zurich carry the usual weekend friction, compounded this weekend by heavy leisure traffic around the Swiss National Day holiday, so generous airport buffers remain advisable with hold luggage best avoided where practical. Travellers connecting through Spain should note an indefinite ground handling strike at Barcelona from Monday. New York enjoys a rare favourable day, with sunny skies, no thunderstorms forecast and no ground stops expected, though the air traffic control staffing shortfall remains structural and morning departures with generous margins remain the standing advice for transatlantic movements.

Digital and privacy exposure

The weekend’s most consequential development for wealth holders is the compromise of the Coldcard hardware wallet. A firmware flaw dating from 2021 caused affected devices to generate their recovery seeds from a weak source of randomness, and on Thursday an attacker who had reproduced the possible seeds offline drained more than 1,000 Bitcoin, worth around 70 million dollars, from almost 1,200 addresses in 41 minutes. The vendor has shipped emergency firmware, but the critical point is that patching does not repair an existing wallet: any principal or family office holding assets on an affected Coldcard device should generate a fresh seed on updated firmware and move the funds without delay, taking specialist advice on the transfer. The second development bears on anyone travelling. Microsoft has detailed a campaign attributed to a Russian state actor in which compromised hotel Wi Fi networks redirect guests to convincing fake browser and system update pages, which install malware capable of capturing the camera, microphone, keystrokes and saved browser sessions, and in some cases steer the guest into the same device code sign in flows covered in yesterday’s briefing. The discipline for travelling principals and staff is absolute: never accept a software update, certificate or sign in code offered through a hotel or airport network, and route all traffic through a trusted VPN from the moment a device connects.

Closer to home, the American residential alarm provider Brinks Home has been breached, with more than a million customer contact records and several million support conversations claimed stolen. Alarm monitoring is reported unaffected, but data of this kind maps households and their security arrangements, and anyone using the service, or contacted by a caller claiming to represent an alarm company, should treat inbound approaches with suspicion and verify through known numbers. The advisers who surround wealth remain under pressure: an American wealth management firm has disclosed a breach exposing client passports, driving licences and account numbers, criminals are impersonating IT support on Microsoft Teams and moving from first call to ransomware in under 17 hours, and a compromised advertising script served by a major ad platform was found silently swapping cryptocurrency addresses copied to the clipboard on ordinary websites. The standing agenda is unchanged: never enter a sign in code you did not generate yourself moments earlier, update Chrome across the household estate, where recent releases have now resolved more than 1,400 flaws, keep unbranded streaming boxes off the main network, and hold absolutely to call back verification on any change to payment instructions.