Saturday, 18 July 2026

Washington deploys additional warplanes to the Middle East as fighting with Iran intensifies

The United States is reportedly sending more warplanes to the Middle East as fighting with Iran intensifies. That adds to a military presence that already includes a naval blockade of Iranian ports and nightly strike operations. Reinforcement of this kind points to planning for a sustained campaign rather than a short punitive cycle. For organisations with regional exposure, the realistic planning horizon moves from days to weeks or months. A long conflict changes the risks security managers have to handle. Staff who cannot be pulled out quickly need rotation and relief, commercial flight options stay degraded, insurance and charter costs climb, and people working through repeated alert cycles grow tired. Move from incident response to managing a campaign. That means a fixed rhythm of threat reviews, decision points agreed in advance for scaling down or evacuating regional operations, and welfare support for staff under prolonged threat. In a conflict shaped like this one, waiting for a single decisive event to trigger action is not a strategy.

Our advisory and intelligence team helps you set up sustained threat monitoring and plan a regional drawdown if it comes to that.

Working exploit public for wp2shell — unauthenticated remote code execution in WordPress core

As of 18 July, the WordPress core vulnerability chain known as wp2shell has CVE identifiers and a working public proof-of-concept, which makes patching far more urgent. The flaw is a pre-authentication remote code execution issue in WordPress core itself. It lets anonymous attackers run code on default installations even with no plugins present, and it is fixed in WordPress 6.9.5 and 7.0.2. A public proof-of-concept usually shrinks the time before mass automated exploitation from weeks to days, and WordPress's install base makes indiscriminate scanning a certainty. Treat this as an emergency change. Find every WordPress instance you run, including marketing microsites, event pages and subsidiaries' sites that often sit outside central IT's view, and patch them or take them offline. For security firms and other reputation-sensitive organisations, a hacked public website gives attackers a foothold for watering-hole attacks on clients, and it costs you credibility directly. Check patch status today, not at the next maintenance window.

Our cyber security team helps you find exposed WordPress sites and other systems, and fix critical vulnerabilities fast.

Iran reports 50 killed and over 500 injured in July US strikes; interim agreement declared effectively suspended

Iran said on 18 July that at least 50 people have been killed and more than 500 injured in US strikes this month, and accused Washington of hitting critical civilian infrastructure. A senior Iranian negotiator described the memorandum of understanding between the two countries as effectively 'suspended', citing what Tehran calls US violations. With the diplomatic track collapsed, the most plausible short-term route to de-escalation is gone, and rising casualty figures make compromise politically harder on both sides. For risk planners, the key change is the loss of predictable off-ramps: military logic and retaliation cycles now drive escalation, not negotiation calendars. Scenario planning for the region should drop the assumption of a quick negotiated pause. Instead, model sustained disruption to Gulf aviation, shipping and energy markets for the rest of the summer. Include the knock-on effects on regional operating costs, insurance and staff willingness to deploy.

Third heatwave of the summer strains European power grids — nuclear curtailments, urban outages and record price spikes

Europe's third heatwave of 2026 is testing the continent's power infrastructure. EDF cut output at several French reactors as cooling-water temperatures rose, with heat-related reductions affecting roughly 12% of France's nuclear capacity. Milan, Bergamo, Turin and other Italian cities had temporary outages driven by air-conditioning demand and infrastructure stress. Up to 106,000 French customers lost power, and German day-ahead electricity prices peaked above €545 per megawatt-hour. Rail networks across Western Europe also faced heat-related disruption. For security managers the exposure is direct: CCTV, access control, alarm transmission and control rooms all depend on the grid, and summer outage risk now comes back every year. Check that UPS units and generators actually carry the security load, and not only IT, for realistic outage lengths. Check that alarm transmission fails over correctly when power drops, and that guarding instructions cover working with degraded technology. Heat resilience belongs in the security continuity plan as well as the facilities plan.

Our advisory team can test your security continuity plan against a summer power outage like these.

Europol-supported operation dismantles French-Spanish hazardous waste trafficking network; four arrested

A joint French-Spanish operation supported by Europol has led to the arrest of four suspects. They are accused of running a cross-border network that illegally moved demolition and industrial waste from France to Spain. At least 46,000 tonnes were secretly buried in farmland in Catalonia, mainly around Sant Esteve Sesrovires. The network used falsified transport documents describing the loads as 'soil' to avoid French environmental taxes and Spanish tax obligations. It has moved thousands of truckloads a year since at least 2022, and analysis confirmed that some buried material contained hazardous substances, including hydrocarbons and heavy metals. Document fraud in logistics chains grows quietly and pays well, and the same forgery techniques that move waste can move stolen goods, sanctioned cargo or worse. If you contract waste handling, haulage or demolition, do real due diligence on the disposal chain. Verify end destinations, check paperwork against physical movements, and treat an implausibly cheap disposal quote as a red flag rather than a saving.

Moroccan intelligence service allegedly targeted Dutch journalist with Pegasus spyware, target-list investigation reveals

Morocco's domestic security service DGST allegedly tried to hack the phone of a Dutch journalist with NSO Group's Pegasus spyware. That is according to reporting published on 18 July, based on a target list obtained by the Spanish newspaper El Confidencial. The journalist, a former NRC correspondent for Spain, Portugal and Morocco who covered protests in the Rif region, appeared on a list of numbers Moroccan intelligence allegedly sought to compromise in 2018–2019. The wider investigation points to attempts against more than 12,000 devices in over 20 countries. Morocco has previously denied using Pegasus. The case backs up what Dutch counter-surveillance practitioners keep saying. State-grade mobile spyware is used against journalists, lawyers, executives and their contacts as well as government targets: anyone whose communications have intelligence value. If you handle sensitive information, treat your phone as a primary point of attack. Use hardened device settings, arrange regular forensic checks for high-risk users, and keep sensitive discussions strictly away from connected devices.

For people and organisations facing state-grade surveillance, we carry out TSCM sweeps and advise on counter-surveillance.

Two further arrests in The Hague drug lab investigation as production sites keep surfacing in residential areas

Police arrested two more suspects on 18 July in the investigation into a drug production laboratory found in The Hague, bringing the total number of arrests in the case to four. Clandestine synthetic drug production remains a structural feature of Dutch organised crime, and its security impact reaches well beyond law enforcement. Labs are routinely set up in rented homes, industrial units and storage premises. That exposes neighbours, property owners and first responders to acute chemical hazards: toxic fumes, fire and explosion risk from improvised processes, and dumped hazardous waste. Property managers and facility operators should know the warning signs: chemical smells, altered ventilation, covered windows, irregular comings and goings at odd hours, and tenants who resist inspections. Reporting suspicions early protects people and premises, while finding a lab through an incident means months of decontamination. Staff who may come across such sites benefit from basic hazardous-environment awareness training.

Our hazardous-environment awareness training prepares staff who may come across drug labs or other chemical hazards in the field.

Dutch variable gas prices climb 12% above pre-war levels as Gulf conflict feeds through to energy costs

Dutch variable gas prices are now roughly 12% above their level before the Middle East war began, according to reporting on 18 July. The Strait of Hormuz crisis is working through into European energy markets. About a fifth of global LNG transit is exposed to the Gulf disruption, and Brent crude is trading more than 15% above pre-war levels. Costs are reaching Dutch businesses and households faster than in earlier supply shocks. For organisations, the security angle is the cost of staying operational. Energy-intensive businesses face margin pressure, which has historically led to cost-cutting rounds, and security budgets are always on the list. Security managers should build the business case now, putting numbers on what guarding, monitoring and response coverage actually prevents, rather than defending budget lines in the autumn. The energy shock also brings back the risks seen in 2022: theft of heating oil, diesel and copper rises with energy prices, so fuel storage and infrastructure sites need renewed attention.

Our advisory team helps you show, in figures, what your security spend prevents before the budget round starts.