Daily intelligence briefing: 25 July 2026

Oil has stepped back from its highs, with Brent settling near 97 dollars a barrel on Friday after reports that Pakistan is exploring a route back to talks between Washington and Tehran, the first tentative signal of de-escalation since fighting resumed. The relief is priced on hope rather than fact: a single tanker transited the Strait of Hormuz on Thursday, the lowest daily count since early May, and the strait remains closed in all but name to large merchant traffic. London remains in routine posture; the collision of a Metropolitan Police marine unit vessel with Westminster Bridge on Friday injured five officers but carries no security dimension, and the Sunday Windrush closure is the main planning point of the weekend. On the digital side, the SharePoint patch and rotate sequence remains the priority, CISA has confirmed nine newly exploited vulnerabilities in a week including two WordPress core flaws, and Progress has told ShareFile customers to shut down storage zone controllers while a threat is investigated.

United Kingdom and London

The national terrorism threat level remains at SEVERE, meaning an attack is highly likely. The most visible incident of the past 24 hours was operational rather than criminal: a Metropolitan Police Marine Policing Unit vessel struck Westminster Bridge on Friday, injuring five officers, who were treated at the scene while the bridge was closed to traffic during the response. No civilians were harmed, river traffic was managed with the Port of London Authority, and the Met has said the incident will be thoroughly reviewed. Routine casework otherwise continues to clear: three men have been jailed for a daylight shooting in Croydon, detectives have named 45 year old Lee Culleton as the man sought over a fatal collision in Romford, and a conviction has followed the seizure of more than 2,000 litres of the controlled substance GBL. The appeal following the serious assault in Hackney after the England World Cup fixture remains live, and the neighbourhood crime figures published this week, showing theft, robbery and vehicle offences down 14% across London over 12 months, continue to describe an improving baseline. Nothing in the past 24 hours alters the assessment that London is operating in a normal policing posture.

The planning picture for the weekend is unchanged. The Windrush line closure on Sunday 26 July, between Sydenham and Crystal Palace and between Wandsworth Road and Clapham Junction, will complicate south London movements, and the more significant disruption follows at the end of the month with no Piccadilly line service between Cockfosters and Uxbridge on 30 and 31 July, including the whole line on the Friday Night Tube, which will bear on late Heathrow connections. No heat health alert was in force at the time of compilation, but the wider weather picture is one of sustained heat and dryness: southern, central and eastern England are approaching drought status after three heatwaves, a Thames Water hosepipe ban is in force, and the first meaningful chance of rain arrives on Sunday morning. The summer peak continues at Heathrow, Gatwick and the Eurostar terminals, and extended check in buffers remain advisable.

Travel corridors

The Gulf picture is unchanged on the ground but has produced its first tentative signal of de-escalation. United States forces completed a thirteenth consecutive night of strikes into Friday, and the human cost continues to accumulate, with 18 American service members killed since fighting resumed. The Strait of Hormuz remains closed in all but name: a single tanker transited on Thursday, the lowest daily count since 7 May, no new vessels entered the strait, and Iran has now conducted more than 30 attacks on commercial shipping. At Bab al Mandeb the position is better than feared, with 32 tanker crossings recorded on Thursday and flows so far not majorly disrupted, although vessels are transiting dark and Saudi Aramco has begun offering alternative loading at Sidi Kerir on the Mediterranean, with reroutings around the Cape adding close to three times the voyage length. Against that backdrop, Brent settled at 96.78 dollars on Friday, down almost 4%, after the reports of a Pakistani channel to resumed talks; the market has taken the hint, but no confirmed process yet exists and the retreat should be read as sentiment rather than substance. The aviation position is unchanged: the EASA guidance advising operators to avoid the airspace of Bahrain, Kuwait, Qatar and the United Arab Emirates runs to 29 July, and 13 foreign carriers have suspended Dubai services into October. Our advice holds: all Gulf travel, including Dubai, should remain deferred, and principals still in the region should depart early on refundable routings.

In Europe, the Monaco investigation produced no overnight development, and the standing advice on parcel and courier discipline holds for principals with commercial exposure to Ukraine or Russia. Paris is likewise quiet following the reopening of the Louvre’s Apollo Gallery, and a low profile with valuables out of sight remains the sensible discipline in France while the national museum security programme beds in. Geneva and Zurich report established summer congestion compounded by periodic air traffic control and technical delays, which have at points this month produced several hundred delayed flights across the two airports in a single day; generous airport buffers remain advisable. New York continues to work through the aftermath of the week’s storms and air traffic control staffing shortfalls, which forced more than 500 cancellations and over 4,000 delays across the three airports; carrier waivers remain in place and generous buffers should be applied to transatlantic movements through the weekend.

Digital and privacy exposure

The SharePoint sequence remains the first item on the technical agenda: patch, remediate, then rotate IIS machine keys. Both CVE-2026-50522 and CVE-2026-58644 now sit on the CISA known exploited catalogue, part of a heavy week in which the agency confirmed nine newly exploited vulnerabilities in seven days. Two of those are WordPress core flaws, the SQL injection CVE-2026-60137 and the interpretation conflict CVE-2026-63030, and any WordPress estate should be treated as under active probing and patched without delay. The remainder of the additions span Fortinet FortiSandbox command injection flaws, a Check Point SmartConsole authentication weakness and older router and development platform bugs. Two further developments deserve attention: Progress has told ShareFile customers to shut down storage zone controllers while a security threat is investigated, a direct concern for the file transfer platforms widely used by professional advisers, and newly disclosed Redis memory flaws enable remote code execution on exposed instances. Separately, Russian state actors have been exploiting a Zimbra webmail flaw that compromises an account when a malicious email is merely viewed, a reminder that mail hygiene controls matter even without a click.

The privacy exposure that matters most to households is unchanged: the breaches at EY, Estee Lauder and Accenture will continue to seed convincing targeted phishing that references firms a family actually uses, and a further incident at Clover Health, where attackers used social engineering to reach employee accounts holding personal and health data, extends the same pattern. Correspondence purporting to come from accountants, consultants, insurers or luxury houses should be treated with heightened suspicion in the coming weeks, and call back verification on any change to payment instructions remains the control that matters most. The reminder on the Adobe Acrobat browser extension stands: update to version 26.5.2.2 or remove it, given the demonstrated route into WhatsApp Web sessions on household devices.