Daily intelligence briefing: 9 August 2026

The Hormuz arrangement has met its first hard reversal. Instead of approving the framework agreed with Oman, Iran’s Supreme National Security Council declared on Saturday evening that the strait will not open until the United States corrects its behaviour, attaching conditions that run from a permanent end to the war to full compensation and the lifting of all sanctions. Hours earlier a missile had struck an ADNOC tanker on passage through the strait, without casualties, prompting the United Arab Emirates to call the attack an act of piracy and demand a full and unconditional reopening. President Pezeshkian struck a softer note overnight, saying the fighting cannot continue forever, and Washington maintains that progress is being made, but no first transit has taken place and the 60 day negotiating window closes in just over a week. In London the heatwave peaks today at 32 degrees under a yellow heat health alert, with an Ashura procession of up to 3,000 expected at Marble Arch and Park Lane this afternoon. New York clears after Saturday storms forced ground stops at all three airports and some 930 cancellations. On the digital side the Coldcard coin has not moved again, the Framework breach has been traced to a critical flaw in the Metabase analytics tool, and the extortion crew calling investment firms on their personal mobiles has begun splintering into new brand names after collecting millions.

United Kingdom and London

The national terrorism threat level remains at SEVERE, meaning an attack is highly likely. The Metropolitan Police newsroom has published nothing new since Friday’s court results, and no significant incident had been reported in the capital at the time of compilation, so the picture carried yesterday stands: the Covent Garden position is unchanged, no fresh developments are reported from the Lambeth and Southwark operation, and the Palestine Action proscription remains fully in force with no significant related gatherings identified this weekend. The day’s principal crowd event is the annual Ashura commemoration: a procession of up to 3,000 participants is expected to move from Marble Arch onto Park Lane from around 15:00, returning by approximately 17:30, with a southbound lane of Park Lane given over to the march and traffic disruption expected around Marble Arch through the late afternoon. The event is well marshalled and policed each year, but movements through Mayfair and the northern end of Park Lane should be routed around it during that window.

Today is expected to be the hottest day of the spell: sunny and around 32 degrees, with high ultraviolet levels and high pollen, and the week ahead holding between 27 and 32 degrees into Friday. A yellow heat health alert from the UK Health Security Agency runs until 21:00 on Tuesday, so the guidance of recent days holds: hydration, shade and vehicle cooling planned into any principal movements, with particular care for older family members and staff posted outdoors. The drought picture has widened by one: South West Water extended its ban to its entire supply area from yesterday morning, sitting alongside Thames Water’s ban, which still covers London and the Thames Valley, and Southern Water has opened a public consultation on its precautionary drought order application for Hampshire and the Isle of Wight. On the railways today’s engineering list is as flagged: no Bakerloo trains between Harrow and Wealdstone and Queen’s Park, the Lioness line suspended, no Suffragette trains until 09:45 with a reduced service until the early afternoon, the Windrush line cut between Wandsworth Road and Clapham Junction, and Barons Court still closed to westbound District and Piccadilly trains until November. The pressure point is the coming week rather than today: RMT members at East Midlands Railway strike again on Saturday, the Arriva bus strikes across north London begin on Friday and Saturday with further dates now published into October, and The Weeknd plays five nights at Wembley Stadium between Friday and the following Wednesday, so movements in north and north west London from Friday onwards should be planned with generous margins. The FA Community Shield, it should be noted, is at the Principality Stadium in Cardiff next Sunday rather than at Wembley.

Travel corridors

Saturday reversed the direction of travel in the strait. In the early hours a missile struck an ADNOC tanker transiting Hormuz, without casualties, the first engagement since Thursday night’s episode south of Qeshm Island; the United Arab Emirates called the attack an act of piracy and demanded that Iran halt the attacks and reopen the strait fully and unconditionally. By evening the diplomacy had hardened as well: rather than approving the framework agreed with Oman, the Supreme National Security Council declared that the strait will not open until the United States corrects its behaviour, listing conditions that include a permanent end to the war with Iran and its allies, the lifting of the naval blockade of Iranian ports, a complete American military withdrawal from the region, full compensation for war damage and the lifting of all sanctions, while the Revolutionary Guard’s spokesman said reopening is not subject to a deal with Oman at all but to full American acceptance of Tehran’s conditions. Washington’s reading is more hopeful than the rhetoric: the Vice President said progress had been made and that Tehran has indicated it has no plans to impose tolls, a mediating diplomat confirmed the temporary accord would prohibit tolls by either side, Foreign Minister Araghchi described the talks with Oman as close to agreement, and President Pezeshkian said overnight that the fighting cannot continue forever and that he hopes the talks will yield results. The gap between the council’s public conditions and the negotiated text is now the central uncertainty, and the 60 day window attached to the interim understanding closes in just over a week. On the water nothing has improved: no first transit has been confirmed, throughput remains around 3 per cent of normal, war risk premiums hold near thirty times their usual level, roughly 300 vessels are holding position, and American forces redirected 51 commercial vessels during the week’s blockade operations. Brent settled at 82.27 dollars on Friday, and the market’s verdict on the weekend’s rhetoric will not be known until Monday’s open. Tehran meanwhile warned Riyadh that its new defence pact with Turkey and Pakistan will not be enough to guarantee its security.

In the Red Sea the Yemeni army reported Houthi missile launches toward the sea from positions east of Taiz on Saturday, with no vessel confirmed struck, and the stated intention to extend attacks to the northern Red Sea stands. Our travel advice does not move: all Gulf travel, including Dubai, should remain deferred until an agreement is not only signed but verified at sea, and any carrier restart should be treated as reversible at short notice. The restarts have nonetheless continued: Etihad resumed its daily Bahrain and Kuwait rotations yesterday and Qatar Airways restored Bahrain, Kuwait and Erbil, though same day listings still showed some rotations cancelled, so individual flights should be confirmed before any movement is built around them. Emirates has yet to relist either route, flydubai and Air Arabia cancellations continue, and Jazeera Airways has restored its Kuwait operation with a three hour check in requirement. The long suspensions are unchanged: British Airways away from Dubai, Bahrain, Amman and Tel Aviv until 25 October, Lufthansa and SWISS away from Dubai until 13 September, which continues to bear on the Zurich corridor, Singapore Airlines and Cathay Pacific until 24 October, and Air Canada until the middle of January 2027.

The Barcelona ground handling strike enters its sixth day with negotiations still blocked and the action now understood to be indefinite: partial cancellations continue through the August peak, delays are exceeding two hours and some departures are leaving without checked baggage, so routings through Barcelona should continue to be avoided where practical; Palma is operating normally. Paris lists no strike action and the August engineering picture is as previously described, with the RER A, B and D and Metro line 13 all carrying closures into the middle of the month and heavy crowding expected on the remaining lines, so airport transfers by road with generous margins remain preferable to rail for the next week at least. Geneva and Zurich are steady: Zurich’s Street Parade drew hundreds of thousands on Saturday and passed without reported incident. In Monaco no new development has been published since Friday’s confirmation of cooperation with the Ukrainian authorities, and the investigation position is as previously described. New York gets its relief today: humidity drops markedly with highs in the low to mid thirties and only a stray afternoon storm possible, after Saturday’s severe weather forced ground stops at Newark, JFK and LaGuardia and cancelled some 930 flights across the three airports. The main carriers’ rebooking waivers run into early this week, and with air traffic control staffing still structurally short, generous margins remain essential on transatlantic movements.

Digital and privacy exposure

The Coldcard coin has not moved again: Friday’s transfer of just over 30 Bitcoin to a fresh wallet remains the only movement by the principal attacker, with roughly nine tenths of the stolen funds still where the thefts left them and the largest single holder sitting untouched on 1,159 Bitcoin across seven addresses. A smaller attacker has begun pushing coin through a mixing protocol in patterns analysts describe as easily flagged, and around 600 marked addresses have been shared with exchanges and law enforcement, so the laundering phase remains early and visible. Two vendor developments deserve note. Coinkite has reversed its long standing deletion policy and will now retain customer records against expected legal obligations, which places a register of hardware wallet owners, itself a targeting dataset of the kind the industry learned to fear after the Ledger leak, into longer term storage. And the Framework breach has been traced to its root: an actively exploited flaw of the highest severity in the Metabase analytics tool, through which customer names, home addresses and telephone numbers were taken, with LexisNexis now confirming impact through a third party running the same software. Any family office or adviser running a self hosted Metabase dashboard should patch immediately. The standing instructions hold: assets on an affected Coldcard device should move to a fresh seed generated on updated firmware without delay, any unsolicited offer to recover stolen Bitcoin is hostile, and on the router question, where the Canadian cyber authority has now published an advisory listing twenty affected models, unbranded or budget routers should be replaced with vetted equipment under professional management.

The telephone remains the sharpest instrument in use. The tracking by Google’s investigators of the extortion crew calling employees’ personal mobiles has hardened into figures: initial demands around three million dollars, typical settlements near three quarters of a million, more than ten million dollars in traced payments in the first five months of the year, and several dozen compromised organisations receiving assistance, with the group now splintering into new brand names after its exposure. The same playbook claimed two further victims disclosed this week: Levi Strauss confirmed corporate data was taken after three employees were socially engineered by telephone, and a cancer diagnostics firm had patient data dumped, including names, home addresses, dates of birth and medical records, after declining to pay, a reminder that the medical records of wealthy patients are prime extortion material. The Microsoft 365 campaign against finance and payroll staff has now been dissected in detail: voicemail themed lures lead through a chain of legitimate services to proxy pages that defeat multi factor codes, after which the attackers sit quietly collecting payroll and banking correspondence, so call back verification on any change to payment instructions holds absolutely. In London the crypto kidnapping case concluded last week moves to sentencing in September, with the alleged organiser still at large abroad, and the seasonal reminder attached to it bears repeating: August is the peak month for burglary, most convicted burglars admit to using social media and mapping tools to select targets, and holiday posting in real time remains the simplest exposure a family can close.