Tuesday, 21 July 2026

CENTCOM completes tenth consecutive night of strikes on Iran; Kuwait and Jordan intercept missiles as ceasefire proposal stalls

US Central Command completed a tenth consecutive night of strikes against Iran into 21 July. Targets included command centres, maritime capabilities, missile and drone launch sites, and air-defence systems tied to attacks on commercial shipping in the Strait of Hormuz. The cycle of retaliation keeps widening. Kuwait intercepted hostile missiles and drones after two earlier rounds of Iranian attacks, and Jordan downed three missiles launched from Iranian territory. The Pentagon confirmed three US service members killed over the weekend, two in Jordan and one in northern Iraq. Mediators have floated a ten-day ceasefire, but Washington has publicly played down the chance it will accept. For organisations with staff in the region, the planning picture is unchanged but getting harder. Air corridors and overland routes across seven states can now close without notice. Duty of care extends to staff in states once treated as safe rear areas. Any contingency plan built on a stable Gulf hub, whether Kuwait City, Amman or Manama, needs a validated alternative.

Mission Support's advisory and intelligence team helps you test contingency and duty-of-care plans for staff across the Gulf and the Levant.

Russian strike kills at least ten on corn ship near Odesa — second fatal attack on a civilian cargo vessel in three days

A Russian strike on a Guinea-Bissau-flagged ship carrying corn near the port of Odesa killed at least ten people on 20 July; the crew came from India and Syria. It is the second fatal strike on a civilian cargo vessel in the Black Sea corridor in three days, after the 19 July attack that killed five crew on a grain carrier. This now looks like targeting, not accident. Civilian status, third-country flags and non-combatant crews are not stopping strikes on ships in the approaches to Ukrainian ports. Through the earlier phases of the war, charterers, cargo owners and marine insurers assumed that grain-corridor traffic carried a higher but insurable risk. That assumption is being repriced in real time. Crewing agencies in India and the Philippines are already reviewing deployment consent for Black Sea voyages. If you have cargo or people in the corridor, treat crew-safety clauses, war-risk cover thresholds and abort criteria as live contract questions this week.

Ukraine answers with 400-drone attack on Moscow region — oil depot, logistics sites and shadow-fleet tankers hit

Ukraine launched one of its largest drone operations of the war early on 20 July, sending around 400 drones against the Moscow region. They struck an oil depot and logistics facilities and wounded ten people; smoke was visible over Podolsk, south of the capital. President Zelenskyy also confirmed strikes on two shadow-fleet tankers and four cargo ships. Russia replied overnight with two guided missiles and 94 strike drones. The lesson for security professionals reaches beyond the front line. Drone attacks of this size on logistics and energy infrastructure deep inside a defended country are now an established capability, not an outlier. If you are responsible for fuel storage, distribution hubs or port-side estates anywhere in Europe, treat this as the testing ground for tactics that tend to spread. A perimeter designed against intruders on the ground does nothing against a threat that arrives from the air. Add detection, reporting and shelter procedures for airborne incidents to your site standing instructions.

NATO warns of state-linked cyberattacks on Europe's civilian ports as alliance formally condemns Russian cyber campaign

NATO has warned that state-linked actors are carrying out cyberattacks on Europe's civilian ports, exposing gaps in maritime digital defence. The North Atlantic Council formally condemned Russia's cyber operations against allies and Ukraine, and the alliance's deputy secretary general called for imposing real costs on Russia and China for cyber and hybrid attacks. Port operators, terminal handlers and the logistics chains that depend on them make up a substantial share of Dutch industry. For them, the warning puts on record what incident data has shown for months: actors with state resources are probing OT systems, berth-management platforms and gate automation. The weak spot is rarely the firewall. It is the handover between IT security and physical operations. Check that a cyber incident hitting access control, gate systems or cargo-release platforms sets off a planned physical-security response, with manual gatekeeping, credential checks and controlled fallback procedures, instead of an improvised one.

Mission Support provides guarding for ports, logistics hubs and critical infrastructure, with written fallback procedures for when gate and access systems go down.

SharePoint zero-day fallout continues: CISA remediation deadline passes as SharePoint 2016 and 2019 exit support

The attacks on Microsoft SharePoint that began with July's record 622-CVE Patch Tuesday are entering a more dangerous second phase. CISA's remediation deadline for CVE-2026-58644, the actively exploited deserialisation flaw that allows unauthenticated remote code execution, passed on 19 July. Incident responders report continued exploitation of unpatched systems. The structural problem is bigger. SharePoint Server 2016 and 2019 reached end of extended support on the same day the patches shipped, so anyone still running those versions has had their last security update while two actively exploited classes of vulnerability circulate. On-premises SharePoint usually holds exactly what a hostile intelligence operation wants: contracts, board papers, M&A files and security documentation. If you cannot migrate straight away, treat legacy SharePoint as possibly compromised. Segment it, limit its exposure to the internet, monitor for the published indicators, and assume documents stored there may already have been read.

If your documents may already have been read, Mission Support's TSCM and technical-security team can help establish what an adversary could still be collecting.

Terror threat remains 'substantial', Dutch security services warn — Iran escalation raises attack likelihood in the Netherlands and Europe

Dutch security services are stressing again that the terrorist threat against the Netherlands remains at level four of five, 'substantial'. The NCTV's half-yearly threat assessment warns that developments around Iran increase the likelihood of an attack in the Netherlands and Europe. Jihadism remains the largest single threat and most plots are being disrupted early. The assessment also flags faster online radicalisation of minors and the normalisation of right-extremist ideology as growing concerns. With the US–Iran confrontation now in its second week, the Iran-linked warning carries more operational weight than when the assessment was drafted. If your organisation has a visible international profile, sits close to diplomatic premises, or has Jewish or Israeli-linked communities nearby, review your security arrangements against the current picture. In practice, tighten access control at publicly accessible premises and brief reception and guarding staff on signs of hostile reconnaissance. Check that escalation routes to the police for suspicious-activity reports are current and tested.

Mission Support provides guarding and access control for offices, residential complexes and publicly accessible premises across the Netherlands, and briefs staff on spotting hostile reconnaissance.

Seven Dutch provinces pool cybersecurity into a joint Security Operations Center as EU deadline pressure mounts

Seven Dutch provinces (Drenthe, Flevoland, Friesland, Limburg, Overijssel, Utrecht and Zeeland) are setting up a shared Security Operations Center to monitor and defend their digital infrastructure together. It is a direct response to the obligations that come with the EU's NIS2-derived rules. Meanwhile the Netherlands itself faces possible legal action from the European Commission for failing to transpose the new cybersecurity law on time. That gap leaves thousands of Dutch organisations formally subject to European obligations without the national enforcement framework that defines them. For private organisations, the provincial move shows where compliance practice is heading: pooled detection, shared incident response and clear rules on who acts when systems are compromised. If you fall under a NIS2 category such as energy, transport, logistics, digital infrastructure or manufacturing, do not read the delayed Dutch law as delayed obligations. The directive's duty-of-care and incident-notification requirements are already the de facto standard that insurers, clients and auditors measure you against.

Netherlands assigns amphibious task group to NATO's Allied Reaction Force; German-Dutch corps takes tactical command for Estonia and Latvia

The Netherlands has assigned an amphibious task group to the NATO Allied Reaction Force, the alliance's rapid-response formation, held at readiness for a full year for immediate deployment anywhere in the treaty area. 1 German-Netherlands Corps has also taken over as the tactical NATO headquarters responsible for Estonia and Latvia. Together with the Dutch contribution to the anti-ballistic-missile coalition reported last week, these assignments confirm where Dutch defence policy is going: committed forward, facing the Baltic, and built into German command arrangements. For civilian security the consequence is capacity. Sustained military commitments this large tighten the market for experienced security personnel, because defence, NATO installations and the protection of related infrastructure absorb cleared professionals. If you are planning security staffing for the second half of 2026, especially at critical-infrastructure or defence-related sites, expect competition for vetted officers. Build lead time into contracting instead of counting on people being available at short notice.