Daily intelligence briefing: 26 July 2026

The United States announced no new strikes overnight into Saturday, the first pause in nearly two weeks of nightly operations, and both sides have confirmed that messages are passing through mediators, with proposals before Tehran that remain under review. The relief is qualified: the blockade of Iranian ports reimposed on 14 July remains in force, the Strait of Hormuz stays closed in all but name, and the conflict has widened at its Red Sea end, where Saudi aircraft struck Houthi positions in Hodeidah on Saturday after the group’s attacks on Saudi tankers and its declared naval blockade of the kingdom. London remains in routine posture; the fatal stabbing in Clapham in the early hours of Saturday is a criminal matter with six arrests already made and carries no wider security dimension. The digital weekend is quiet: a published proof of concept for a GitLab remote code execution flaw is the main new technical item, and the standing priorities on SharePoint, WordPress and ShareFile are unchanged. Separately, EASA has extended its Gulf airspace guidance to 31 August, a longer horizon than previously reported.

United Kingdom and London

The national terrorism threat level remains at SEVERE, meaning an attack is highly likely. The most significant incident of the past 24 hours was the fatal stabbing in Clapham in the early hours of Saturday morning. A 22 year old man was attacked at around 04:20 close to Tremadoc Road, near Clapham High Street, and died in hospital despite medical intervention. Six men have been arrested on suspicion of murder, four of whom presented at hospital with stab wounds, and four further men suffered injuries that are not believed to be life threatening or life changing. The pattern points to a violent confrontation within a single group rather than anything with a wider public dimension, and detectives describe their enquiries as progressing quickly, with witnesses asked to contact police quoting reference 1474/25July. The incident does not alter the assessment that London is operating in a normal policing posture, though it is a reminder that the late night economy carries its own risks and that movements through busy nightlife districts in the small hours are best planned rather than improvised.

The planning picture for Sunday 26 July is dominated by rail works. The DLR runs with partial closures between Canary Wharf and Stratford, between Canary Wharf and Bank, and between Canning Town and both Bank and Tower Gateway, with replacement buses in operation, which will slow movements to and from Canary Wharf and London City Airport. The Mildmay line runs a reduced service between Richmond and Stratford with no service between Clapham Junction and Willesden Junction all day, the Windrush line has no service between Highbury and Islington and Dalston Junction after 22:15, and the Suffragette line remains closed between Barking and Barking Riverside until Monday morning. The more significant disruption still sits at the end of the month, with no Piccadilly line service between Cockfosters and Uxbridge on 30 and 31 July, including the whole line on the Friday Night Tube, which will bear on late Heathrow connections. The weather has turned: high pressure is breaking down, the weekend feels markedly cooler, and rain is reaching Scotland, Northern Ireland, northern England and north Wales, with only sporadic showers further south and east. The drought backdrop is unchanged, with North Wales and the Upper Severn formally entering drought status on Thursday, hosepipe restrictions covering more than 20 million customers across England, and parts of Surrey now seven weeks without rain. The summer peak continues at Heathrow, Gatwick and the Eurostar terminals, and extended check in buffers remain advisable.

Travel corridors

The Gulf has produced its most meaningful de-escalation signal since fighting resumed: the United States announced no new strikes overnight into Saturday, the first pause after thirteen consecutive nights of operations. The White House says dialogue with Tehran continues and that a wider attack may prove unnecessary, while stressing that forces remain ready, and Iranian officials have confirmed that messages are being exchanged through mediators, with proposals conveyed to Tehran still under review. The disagreement now centres on the strait itself, with the Iranian foreign minister accusing Washington of violating the June memorandum by imposing a new Hormuz transit route without consultation. The ground truth is unchanged: the blockade of Iranian ports reimposed on 14 July remains in force and the strait stays closed in all but name to large merchant traffic. The conflict has meanwhile widened at its Red Sea end. Following the Houthi declaration of a naval blockade of Saudi Arabia on 20 July and the group’s claimed attacks on two Saudi tankers in midweek, Saudi aircraft struck Houthi positions in Hodeidah on Saturday, and the risk to Bab al Mandeb transits, which had held up better than feared, has clearly risen. Brent ended the week at 96.78 dollars after Friday’s fall of almost 4%; markets are closed over the weekend and Monday’s open will price the strike pause and the Red Sea escalation against each other. On aviation, EASA has extended its conflict zone guidance for the Gulf to 31 August, a revision issued on 22 July that supersedes the 29 July horizon we reported last week, and Emirates, Etihad, flydubai and Air Arabia cancelled further Kuwait, Bahrain and Jordan rotations this weekend, although UAE airports themselves continue to operate normally and 13 foreign carriers remain suspended on Dubai services into October. Our advice holds: all Gulf travel, including Dubai, should remain deferred, and principals still in the region should depart early on refundable routings.

In Europe, the French national counter terrorism prosecutor announced on Saturday that six people have been detained over a suspected Islamist plot targeting a synagogue in Sarcelles, north of Paris, the follow through from the 12 July operation in which some 300 people were evacuated after a suspicious vehicle was found near the site. The arrests are a disruption success rather than a warning of imminence, and no change to posture in Paris is advised, though a low profile near community and faith locations remains the sensible discipline while the investigation continues. The Monaco investigation produced no overnight development, and the standing advice on parcel and courier discipline holds for principals with commercial exposure to Ukraine or Russia. Geneva and Zurich report established summer congestion compounded by periodic air traffic control and technical delays, which have at points this month produced several hundred delayed flights across the two airports in a single day; generous airport buffers remain advisable. New York continues to recover from the week’s storms and air traffic control staffing shortfalls, which forced more than 500 cancellations and over 4,000 delays across the three airports; carrier waivers remain in place and generous buffers should be applied to transatlantic movements through the weekend.

Digital and privacy exposure

The weekend has brought few new disclosures and the technical priorities are unchanged. The SharePoint sequence of patch, remediate and rotate IIS machine keys remains first on the agenda, with CVE-2026-50522 and CVE-2026-58644 both on the CISA known exploited catalogue. The WordPress core flaws CVE-2026-60137 and CVE-2026-63030 remain under active probing and any WordPress estate should be patched without delay, ShareFile storage zone controllers should remain shut down in line with the Progress guidance while its investigation continues, and the Redis and Zimbra items reported this week continue to warrant attention. The main new item is the publication of a working proof of concept for a GitLab remote code execution flaw affecting self managed instances on version 18.11.3, which allows any authenticated user to run commands with the privileges of the git user. Family offices and advisers running self managed GitLab should apply the available update and restrict account creation in the interim.

On the household side, reporting this week indicates that Apple’s Hide My Email feature can in certain circumstances expose the real address behind a masked one. Masked addresses should be treated as a convenience rather than a guarantee, and genuinely sensitive correspondence is better handled through a dedicated account. The breach pattern that feeds targeted phishing continues to build: AssuranceAmerica has confirmed a compromise affecting nearly seven million driver records after an employee account was breached, attackers claim to have taken 35 gigabytes of data from Accenture, which the firm has advised treating as potential credential compromise, and the earlier incidents at EY, Estee Lauder and Clover Health will continue to seed convincing approaches that reference firms a family actually uses. Correspondence purporting to come from accountants, consultants, insurers or luxury houses should be treated with heightened suspicion, and call back verification on any change to payment instructions remains the control that matters most. Finally, researchers have documented the first ransomware operation conducted almost entirely by an autonomous artificial intelligence agent, exploiting a Langflow vulnerability for reconnaissance, credential theft and encryption; the practical lesson is that patch windows are shortening and unpatched internet facing services are found faster than ever.