MEFILES — Daily Intelligence on the Region's Hard Questions

Iran File — Lead

Riyadh Stopped Being a Mediator on Tuesday, and the Hormuz Track Lost the Only Broker Tehran Was Calling

US Central Command said on Tuesday that Saudi and American aircraft struck Iran-aligned groups in Iraq, and Riyadh confirmed it took part in coordination with CENTCOM. Twenty-four hours earlier, Iran’s foreign minister had telephoned his Saudi counterpart about insecurity in the Strait of Hormuz. The Islamabad memorandum that both tracks nominally serve runs out of time on 16 August. Baghdad, on whose territory the strikes landed, has said nothing anyone has published.

MEfiles · Iran File · July 29, 2026

Tuesday, in four figures

The claims and the clock around the joint US–Saudi strikes of 28 July 2026

Days of paused US strikes before Tuesday

Iranian missiles CENTCOM says got through

PMF members the PMF says were killed

Days until the Islamabad MoU's 60-day limit

CENTCOM, CBS News, Al Jazeera (PMF claim), CNN (MoU text)

CENTCOM’s release, filed from Tampa on 28 July, says US Central Command and the Saudi Arabian Armed Forces “conducted precision strikes in Iraq, July 28, against Iran-aligned terrorists that the Islamic Revolutionary Guard Corps (IRGC) directed to attack U.S. forces and Saudi energy infrastructure.” The wording carries the political predicate for Saudi participation: not the nuclear file, not the American air campaign, but Saudi refineries. Al Jazeera reports that Riyadh said separately it had carried out targeted strikes on Iran-backed armed groups in Iraq in coordination with CENTCOM — a Saudi acknowledgement, not merely an American one — and that the Popular Mobilisation Forces say eight of its members were killed and four wounded in strikes on PMF headquarters across Iraq. Those casualty figures are a claim by one belligerent and are not independently verified. The Washington Post, citing unnamed officials, described the operation as “marking what appeared to be Riyadh’s direct entry” into the conflict. The immediate precursor is on the record: CNBC reported that overnight into Tuesday Saudi Arabia said its air defences had intercepted a number of drones launched by Iran-backed militias in Iraq at the kingdom’s oil facilities.

On Monday evening, Iranian Foreign Minister Abbas Araghchi telephoned Prince Faisal bin Farhan and Oman’s Badr Albusaidi. IRNA said the focus was “advancing diplomatic efforts to establish regional stability and address insecurity in the Strait of Hormuz,” and that the ministers emphasised strengthening cooperation; the Iranian readouts released no further detail. That call is the clock the strikes now run against. Al Jazeera reported on Tuesday that Iran and Oman have exchanged proposals to manage the strait, and that Washington suspended a nearly two-week air campaign at the weekend after pressure from regional mediators to return to the memorandum of understanding signed in June. The memorandum’s own text, published by CNN, commits the parties in point three to reach a final agreement “within a maximum period of 60 days, extendable by mutual consent” — sixty days from 17 June ends on Sunday 16 August. The gap to be closed is large. Paul Musgrave of Georgetown University in Qatar told Al Jazeera that voluntary contributions under the Strait of Malacca model raise about $70m a year, against the $1m per ship reportedly proposed by Tehran as a Hormuz service fee.

The second half of Tuesday’s sequence is thinner than the first. CENTCOM said that at 5:45 p.m. ET “Islamic Revolutionary Guard Corps forces launched multiple ballistic missiles from Iran in an attempted surprise attack on U.S. forces based in the Middle East,” that all were intercepted, and that US forces “remain vigilant and at a high state of readiness.” It gave no count, no launch sites, no location and no damage assessment; CNN and Fox both noted the absence explicitly. No Iranian confirmation, denial or IRGC claim of responsibility has surfaced. Reporting placing the target in Jordan rests, in the version this desk could reach, on RT relaying an unnamed senior US official quoted by Axios — a state broadcaster carrying a single anonymous source in a third outlet. Euronews reported on Wednesday morning that the US military had warned Iran to halt attacks, directly or through proxies, on US assets in the Gulf or on Saudi energy infrastructure in order to “avoid further military response.” CBS put the broken lull at five days.

Nothing published so far carries an Iraqi voice. The PMF is a state-salaried body under Iraqi law, and the strikes hit its headquarters on Iraqi soil, yet no reaction from the Iraqi government appeared in the wire and regional coverage this desk retrieved, and no Iraqi casualty figure independent of the PMF’s own exists. That is the gap that will determine whether Tuesday was an episode or a threshold: Baghdad can absorb an American strike on a militia compound, as it has repeatedly, but a Saudi one implicates a neighbour it has spent three years rebuilding relations with, and one whose foreign minister was on the phone with Tehran the night before.

Assessment: Riyadh’s move is legible on its own terms — drones aimed at its refineries, an American umbrella, a legal predicate written into the CENTCOM release — but it costs something that was not Riyadh’s to spend. The Hormuz track worked because Tehran had two Gulf interlocutors it would take calls from. It now has one, and Muscat’s proposals must survive without Saudi weight behind them, eighteen days from the memorandum’s expiry. Distrust the tidiness of Tuesday. “All Iranian missiles were successfully intercepted” is an unquantified claim from the party that was shot at, with no count, no location and no adversary confirmation; the Jordan detail is single-sourced through a state broadcaster; the eight PMF dead are a militia’s own figure. Distrust “joint” as well — it is doing heavy work for an operation whose Saudi component nobody has described. And watch whether the pause is treated as over. Washington framed Tuesday as a response to attacks on Saudi energy, not as a resumption of the campaign against Iran. That distinction is the only thing keeping the paper alive.

Sources: US Central Command — U.S., Saudi Forces Strike Iran-Backed Terrorist Sites in Iraq · Al Jazeera — Saudi Arabia and US carry out strikes on Iran-backed groups in Iraq; PMF says eight killed · Washington Post — US says it shot down Iranian missiles; joint strikes mark Riyadh’s direct entry · Euronews — US warns Iran to halt attacks on US assets and Saudi energy infrastructure · CNBC — Saudi Arabia says it intercepted drones launched by Iran-backed militias in Iraq at oil facilities · IranWire — Araghchi holds calls with Saudi and Omani counterparts on the Strait of Hormuz · Al Jazeera — Iran and Oman exchange proposals to manage the Strait of Hormuz; Musgrave on the Malacca model · CNN — Full text of the Islamabad memorandum of understanding, 17 June 2026

The Cartoon — July 29

“You can broker or you can bomb. The ledger only balances one way.”

MEFILES · the cartoon · Saudi jets flew with CENTCOM over Iraq a day after Iran’s foreign minister called Riyadh about the Strait of Hormuz

$1m

Per-ship Hormuz “service fee” reportedly proposed by Tehran, against roughly $70m raised annually under the Strait of Malacca model

Paul Musgrave, Georgetown University in Qatar, to Al Jazeera; Al Jazeera notes the $1m figure is “reportedly” proposed

18,000

Target strength Tiani gave for the AES joint force on state broadcaster RTN, against 5,000 at its launch in December 2025

Bloomberg, 26 July 2026, citing Tiani’s RTN interview

500,000

El Obeid’s pre-war population; WFP says the city may now shelter almost twice that, and no one has re-measured since the highway changed hands

WFP Sudan country director Abdallah Aldawart, via Dabanga

3 of 4

Individuals in OFAC’s 23 July Brotherhood tranche who are based in Türkiye; Ankara has issued no response this desk could find

US Treasury press release SB0572, 23 July 2026

30+

Minnesota community water systems touched in a two-day coordinated intrusion; four cities disclosed and no party has claimed it

Minnesota IT Services, via FOX 9 and Reuters

Iran File

The regime, the IRGC, the proxies, the strait — read from the Gulf, not from Washington.

Escalation for Escalation

Saudi Jets Fly With CENTCOM Over Iraq After Missiles Fly at American Forces

Riyadh acknowledged striking Iran-aligned groups in Iraq in coordination with US Central Command, hours after CENTCOM said it intercepted an IRGC ballistic missile salvo aimed at American forces. The five-day pause in US strikes on Iran ended on both counts.

US Central Command said in a statement posted to X that at 5:45 p.m. ET on Tuesday, “Islamic Revolutionary Guard Corps forces launched multiple ballistic missiles from Iran in an attempted surprise attack on U.S. forces based in the Middle East. All Iranian missiles were successfully intercepted.” CENTCOM gave no missile count, no launch sites and no target locations; CNN’s live file noted explicitly that “CENTCOM did not give details on the location,” and Fox 26 Houston, carrying the Fox/AP feed, recorded that CENTCOM “did not say how many missiles were fired or where they were headed.” No Iranian confirmation, denial or IRGC claim of responsibility has surfaced. RT, the Russian state broadcaster, reported the target was US forces in Jordan, attributing that to an unnamed senior US official quoted by Axios — a single anonymous source at one remove, and not confirmed by CENTCOM.

Late the same day, CENTCOM issued a public release from Tampa titled “U.S., Saudi Forces Strike Iran-Backed Terrorist Sites in Iraq,” saying it and the Saudi Arabian Armed Forces “conducted precision strikes in Iraq, July 28, against Iran-aligned terrorists that the Islamic Revolutionary Guard Corps (IRGC) directed to attack U.S. forces and Saudi energy.” Al Jazeera reported that Saudi Arabia itself said it had struck Iran-backed armed groups in Iraq in coordination with CENTCOM — a Saudi acknowledgement, not merely an American one — and that Iraq’s Popular Mobilisation Forces said eight of its members were killed and four wounded in strikes on PMF headquarters across the country. Those casualty figures are a PMF claim and are not independently verified. The Washington Post, citing unnamed officials, called the operation “what appeared to be Riyadh’s direct entry” into the war.

The Saudi predicate was laid the night before. CNBC reported that Saudi Arabia said its air defences intercepted a “number of drones” launched by Iran-backed militias in Iraq at the kingdom’s oil facilities. Al Jazeera earlier carried user-generated video dated 25 July, verified by AFPTV, showing smoke after strikes on the Aramco refinery at Jizan; The National has reported Houthi claims against Aramco sites at Jizan and Yanbu. Euronews, filing Wednesday morning, reported the US military warned Iran to halt attacks conducted directly or through regional proxies against US assets in the Gulf or against Saudi energy infrastructure in order to “avoid further military response.” CBS put the broken lull at five days and said it was unclear whether or when the pause resumes.

Assessment: Note which claim each party chose to make. CENTCOM asserted IRGC direction of the Iraqi groups and named Saudi energy as the protected object — that sentence is the legal scaffolding for a Saudi combat role, written before anyone asked for it. Riyadh, for its part, put its own name on the operation rather than hiding behind Washington, which is the harder commitment to walk back. Two things remain unestablished: that missiles were in fact launched from Iran, which rests entirely on a US statement with no numbers, and Baghdad’s position. The PMF is a state-salaried body under Iraqi law. A foreign air force struck its headquarters and the Iraqi government has said nothing we can read. That silence is the next beat.

Sources: CENTCOM — U.S., Saudi Forces Strike Iran-Backed Terrorist Sites in Iraq · Al Jazeera — Saudi Arabia, US carry out strikes on Iran-backed groups in Iraq; PMF says eight killed · Washington Post — US says it shot down Iranian missiles targeting troops · CNN live file — CENTCOM did not give details on the location · Euronews — US warns Iran to halt attacks, launches joint strikes with Saudi Arabia · CBS News — Strikes could challenge a five-day lull

Eighteen Days

Araghchi Called Faisal bin Farhan on Monday; Saudi Jets Bombed His Allies on Tuesday

Iran and Oman are exchanging written proposals to reopen the Strait of Hormuz, and Tehran’s foreign minister spoke to his Saudi counterpart the night before Riyadh joined the air war. The Islamabad memorandum’s 60-day clock runs out on 16 August.

IRNA reported that Foreign Minister Abbas Araghchi held separate telephone calls on Monday evening with Saudi Foreign Minister Prince Faisal bin Farhan and Omani Foreign Minister Badr Albusaidi, focused on “advancing diplomatic efforts to establish regional stability and address insecurity in the Strait of Hormuz,” with the ministers emphasising “the necessity of strengthening cooperation.” The readouts released no further detail. CNBC carried the substance from Araghchi’s Telegram channel via machine translation. Pakistan Observer noted the call with Faisal bin Farhan came shortly after Riyadh announced it had intercepted drones aimed at its oil facilities. On the Omani track, Bloomberg reported on 27 July that Iranian and Omani negotiators “are trying to reach an agreement to restart shipping through the Strait of Hormuz, according to people familiar with the matter.” The Wall Street Journal, as relayed by the Jerusalem Post, reported Omani officials proposed a joint body to oversee maritime security and search-and-rescue in the strait.

Iranian foreign ministry spokesman Esmaeil Baqaei called the negotiations “productive” and said technical and political consultations continue; an Omani delegation arrived in Tehran on Friday 24 July. The gap between the two sides is arithmetical. Paul Musgrave of Georgetown University in Qatar told Al Jazeera that under the Strait of Malacca model, voluntary contributions raise about $70m annually — far short of the $1m per ship that Al Jazeera says Tehran has “reportedly” proposed as a Hormuz service fee. All of it runs against a clock. The Islamabad memorandum signed on 17 June, whose 14-point text CNN published after what it described as an outcry that the text had not been released, commits the parties in point three to “negotiate and reach a final agreement within a maximum period of 60 days, extendable by mutual consent.” That expires on Sunday 16 August. Türkiye Today reports the memorandum has been suspended since early July.

Assessment: The two tracks are not sequential; they are simultaneous, and Monday’s phone call is the proof. Tehran’s chief diplomat sought out Riyadh hours before Riyadh’s aircraft struck the militias CENTCOM says the IRGC directs. Read that as evidence the Gulf channel is being kept open deliberately by both capitals, not as evidence either is bluffing. Javad Heiran-Nia of the Persian Gulf Studies Group makes the structural point: the memorandum was built to stop shooting and reopen the strait, not to settle the dispute, and mediators lack instruments to settle it absent a shift in the balance of power. Which is an argument for more limited military engagements before 16 August, not fewer. Treat the $1m-per-ship figure as unsourced.

Sources: Al Jazeera — Iran and Oman exchange proposals to manage Strait of Hormuz · Bloomberg — Iran-Oman talks focused on restarting Hormuz shipping traffic · IranWire — Araghchi holds talks with Saudi, Omani counterparts on Strait of Hormuz · CNN — Full text of the 17 June Islamabad memorandum of understanding · Türkiye Today — Baqaei calls Iran-Oman talks productive; memorandum suspended since early July · Jerusalem Post — WSJ: Oman proposed joint maritime body for the strait

Sahel Monitor

Mali, Burkina, Niger, the AES bloc, JNIM, and the Russian bargain — security as economics.

An announcement, not a force

AES joint force strength at its December 2025 launch against the figure announced on 26 July 2026

Africanews (launch, 21 December 2025); Bloomberg citing Tiani on state broadcaster RTN (26 July 2026)

Announcement as Capability

Tiani Puts the AES Joint Force at 18,000 on the Coup’s Third Anniversary, and Only RTN Heard Him

The figure originates with the man announcing it and reached the wires through Niger’s state broadcaster. By the time Russian-aligned outlets had rewritten it two days later, the same expansion had grown by 40 percent.

Bloomberg reported on 26 July that Abdourahamane Tiani said the three military-led governments of the Alliance of Sahel States plan to more than triple their joint force to 18,000 troops, following what he described as a decision by the three countries' defence ministers. The provenance chain runs junta leader to state broadcaster RTN to wire; there is no independent confirmation that such a ministerial decision was taken, and the Bloomberg copy carries no budget, no timeline and no basing detail. The baseline, by contrast, is documented: Africanews reported the force’s launch on 21 December 2025 at 5,000 personnel, at a ceremony at an air force base in Bamako presided over by Assimi Goïta. Malian and Burkinabè troops make up the balance of the formation alongside Niger’s.

Two days later the Russian-aligned Pravda Mali site carried the same announcement under a “quintuple” framing, added that the force is based in Niamey, and asserted that it has “already carried out classified operations” — a claim absent from the wire copy and constructed so that it cannot be checked. The arithmetic is not close: 5,000 to 18,000 is 3.6 times, which is what “more than triple” describes and not what “quintuple” describes. The timing is also not incidental. The coup against Mohamed Bazoum took place on 26 July 2023, making the RTN interview an anniversary appearance; allAfrica marked the date on 28 July under the headline “Niger’s Junta Marks Three Years Amid Rising Violence and Lost Freedoms,” a piece THE FILES has seen only in headline.

Assessment: Thirteen thousand additional soldiers have to be drawn from three armies already committed against JNIM and Islamic State in the Sahel, in states that do not publish defence budgets. Read the 18,000 as a message rather than an order of battle: it addresses domestic audiences on an anniversary and foreign partners who are being told the AES no longer needs them. The test is dull and specific — a published cost, a garrison, a named commander. Note also how the number grew after it left the wire. Niamey’s own record on assertion is on file: in January it named France, Benin and Côte d’Ivoire as authors of the Diori Hamani airport attack, an accusation that was never a finding.

Sources: Bloomberg — Niger says Sahel bloc to triple forces as Islamist attacks mount · Africanews — Burkina Faso, Mali and Niger launch Sahel regional force at 5,000 strong · Pravda Mali (Russian-aligned) — the same announcement rewritten as a fivefold expansion · allAfrica — Niger’s junta marks three years amid rising violence and lost freedoms · Al Jazeera — Niger’s military government accuses France, Benin and Côte d’Ivoire over airport attack

Who Is Publishing What

The Africa Corps Atrocity File Recirculates Through AFRICOM and Kyiv While Dakar Argues Moscow Is Slipping

No new verified incident in Mali was recorded in the past 48 hours. What moved instead was the same set of claims, through outlets whose sponsors each have a separate reason to move them.

Africa Defense Forum, which is published by US Africa Command, posted a piece on 28–29 July headlined “Africa Corps Accused of Atrocities in Mali”; THE FILES has the headline and timestamp, not the body. The specific allegation in circulation since late June — that Malian troops and Africa Corps personnel killed civilians and arranged human remains into a swastika — originates with a rights group, and its loudest amplifiers have been Ukrainian outlets, United24 Media on 26 June and Mezha/Bukvy on 25 July, with Maghrebi.org carrying it on 25 June. None of that constitutes a new confirmed event inside the window, and the desk is treating it as a claim in propagation rather than as reporting.

The methodologically transparent anchor underneath all of it remains eight months old. AP reached the Mauritanian border in December 2025 and interviewed 34 refugees who described indiscriminate killings, abductions and sexual abuse; most spoke anonymously, fearing retaliation. Two showed video of villages they said had been burned by “white men.” A Malian village chief who had fled told AP: “It’s a scorched-earth policy.” AP also recorded the two attribution facts that still hold: Malian authorities have never publicly acknowledged the presence of Wagner or Africa Corps, while Russia’s Foreign Ministry has confirmed the unit is active “at the request of the Malian authorities.” The Russian Defence Ministry did not answer AP’s questions. The Sentry’s April 2026 report mapped the same footprint from the logistics side, including new military deliveries and a maritime hub in Guinea.

Against that, the Dakar-based Timbuktu Institute published on 28–29 July under the title “Niger and the AES: between security gains and the weakening of the Russian military partnership” — again headline only, and worth flagging precisely because it contradicts the week’s dominant reading. That reading rests on The Africa Report’s 24 July piece on an Africa Corps convoy taking a hazardous new overland route into Mali to circumvent sanctions. The convoy’s much-quoted size, 200 to 300 vehicles, came from militants, was relayed by Pravda Mali on 17 July, and is unverified; every link in that chain has an interest in a larger number.

Assessment: Three sponsors are pushing the same Mali file for three unrelated reasons: AFRICOM to raise the reputational cost of the Russian bargain, Ukrainian outlets to fight Moscow in third countries where the fighting is cheap, and the Kremlin-aligned network to advertise reach. Recirculation is not corroboration. The more useful signal is the absence of any fresh sample-based documentation since December — a measurement failure in a closed information space, not evidence that anything has improved. If the Timbuktu reading holds on a full text, the implication is that Africa Corps is one arrangement priced three different ways, and that Niamey’s price is falling while Bamako’s is not.

Sources: Africa Defense Forum (published by US AFRICOM) — Africa Corps accused of atrocities in Mali · AP via ABC News — 34 refugees on the Mauritanian border describe killings, abductions and abuse · AP via Arab News — same investigation, including Moscow’s “at the request of the Malian authorities” line · The Sentry — Russia doubles down in West Africa: deliveries, a Guinea maritime hub, Africa Corps footprint · Timbuktu Institute — Niger and the AES: security gains and the weakening of the Russian military partnership · The Africa Report — Africa Corps convoy circumvents sanctions on a hazardous new route to Mali

Sudan Crisis Monitor

SAF versus RSF, the sieges and the famine, the gold economy, and the diplomacy of press releases.

El Obeid, three counts

Pre-war residents, recorded displaced arrivals, and WFP's current working estimate

OHCHR/UN News (early July 2026); WFP Sudan country director, via Dabanga (week of 20 July 2026)

Advance and Retaliation

The Army Says the Highway Is Its Own; Hemedti Hands the Next Offensive to His Field Commanders

Sudan’s army declared control of the 400km Omdurman–El Obeid export road on Tuesday. A day earlier, drones hit El Obeid at dawn, and Mohamed Hamdan Dagalo told his commanders they no longer need to wait for orders.

The operation began Saturday 25 July from army positions at Raheed al-Nuba, west of Omdurman. By Sunday the Sudanese Armed Forces and the allied Joint Force — the army plus Darfur armed movements — said they held Bara, Um Sayala, Um Qurfa, Jabrat al-Sheikh and Al-Baraka, and on Tuesday 28 July the army announced it controlled the export road linking the capital region to North Kordofan. The territorial inventory is a belligerent’s, as is the claim carried by Qatar News Agency that 73 RSF combat vehicles were destroyed. The direction of travel, though, is corroborated: AFP journalists in El Obeid reported the outcome, and two army sources told the wire on condition of anonymity that the RSF had been pushed west off the 400km highway. Dabanga’s field sources say an RSF counter-attack to retake the ground was repelled.

At dawn on Monday 27 July, drone strikes hit two municipal buildings in El Obeid, destroying the local lawyers' association. An AFP reporter in the city confirmed the strikes; the wire attributes them only as blamed on the RSF. On the same day Dagalo said his field commanders would now have full autonomy to launch offensives without waiting for central orders — reported by Sudan Tribune from Nairobi, with The National running a companion AFP-sourced piece on 28 July framed as an attempt to rally fighters after losses. Burhan, meanwhile, appeared flanked by Minni Minawi and Sudan Shield Forces commander Abu Aqla Kaykal, and ordered forces to clear the country up to the Central African Republic border.

Assessment: Bara has been announced retaken before — a Sudans Post report dated 6 March 2026 describes the same town falling to the same coalition. That date needs checking, but if it holds, the “turning point” framing collapses into a five-month cycle. Geeska’s account, that the whole push was a counter-offensive triggered by an RSF attack south of El Obeid, cuts the same way. Read Dagalo’s devolution order as the day’s real disclosure: whether it reflects broken communications or a deliberate diffusion of responsibility, anyone negotiating a truce now faces a counterparty who has said on the record that he does not set the tempo of his own war.

Sources: Sudan Tribune — army and Joint Force declare control of North Kordofan towns · QNA — Sudanese army announces recapture of Bara and other areas · AFP via France 24 — drone strikes rock El Obeid after army secures highway · Sudan Tribune — Dagalo grants field commanders autonomy · Sudan Tribune — Burhan orders forces to clear the country to the CAR border · Sudans Post — earlier report of Bara’s recapture

The City That Doubled

El Obeid May Now Hold Twice the People It Was Built For, and No One Has Re-Measured Since the Highway Changed Hands

WFP calls El Obeid the epicentre of Sudan’s displacement and hunger crisis. Every published aid figure for the city predates this week’s military shift.

El Obeid was home to roughly 500,000 people and “may now be sheltering almost twice that number”, the World Food Programme said after country director Abdallah Aldawart visited during the week of 20 July. He called the city “the epicentre of Sudan’s displacement and hunger crisis”, with arrivals from North, South and West Kordofan and from Darfur, and camps overflowing. WFP requires $646 million for June through November. The office of High Commissioner Volker Türk documented 15 drone strikes on El Obeid and surrounding areas across three weeks in June, killing at least 45 civilians. A UNFPA flash update on 2 July said the attacks had become near-daily and were systematically targeting power substations, fuel stations, water facilities and healthcare infrastructure “as part of a sustained campaign to impose siege-like conditions”.

The UN told AFP that more than 1,000 people have been killed by drone strikes by both forces in Kordofan alone since the start of 2026. Aid workers put the national death toll since April 2023 above 200,000 — an estimate, not an official count — with more than 33 million people in need. El Obeid was besieged once before, from April 2023 until the army broke the encirclement in February 2025. On 8 July the Human Rights Council’s Fact-Finding Mission for Sudan warned the city “must not become the next crime scene”, documenting the same pattern of encirclement and strikes on civilian infrastructure that preceded the fall of El Fasher. The International Rescue Committee had warned on 2 July that an imminent RSF ground offensive was pushing North Kordofan toward catastrophe.

On the diplomatic track nothing has moved. The RSF’s 14 July response to Massad Boulos’s US plan accepts an unconditional three-month truce for UN-supervised aid in Darfur, Kordofan, Ed Damazin and the Nuba Mountains — a detail attributed to an RSF official speaking anonymously — while rejecting partial withdrawal from positions in North Darfur and North Kordofan. Burhan, in Asmara on 17 July with Isaias Afwerki, restated that any truce must be preceded by RSF withdrawal from cities. Boulos has publicly said reports that only the withdrawal question remains outstanding are inaccurate.

Assessment: The humanitarian file and the battlefield file are now a week out of sync, and that gap is where the coming misreporting will happen. An open export road is not the same as delivered food: the corridor runs through territory the army says it holds and the RSF is contesting by air, and the aid figures now circulating were measured before Monday’s strikes. Note also who the advance strengthens. The structural deadlock — truce without withdrawal versus withdrawal before truce — was frozen when both sides were stuck. Burhan has less reason to move this week than last, not more.

Sources: Dabanga — WFP calls El Obeid the new epicentre of Sudan’s hunger crisis · UN News — OHCHR on relentless drone strikes on El Obeid · UNFPA — flash update on the situation in El Obeid, 2 July 2026 · IRC — warning of an imminent RSF offensive in North Kordofan · Sudan Tribune — RSF response to the US truce proposal · Mada Masr — Burhan in Asmara, ceasefire conditions top the agenda

The Brotherhood Brief

The organization as structure — designations, networks, finances, legal battles. Structure over slogans.

Where the designated men live

Residence of the four individuals in OFAC's 23 July 2026 Brotherhood–Hamas tranche

US Treasury press release SB0572, 23 July 2026

Istanbul, Not London

Three of the Four Sanctioned Men Are Based in Türkiye, and Ankara Has Said Nothing

The 23 July OFAC tranche is being read in Europe as a London story. Its numerical centre of gravity is a single Türkiye-registered trading company, and no Turkish official has responded in the six days since.

The Treasury designation issued Thursday 23 July under Executive Order 13224 named four individuals and three entities. One individual, Mahmoud al-Abyari, is described by the Office of Foreign Assets Control as a United Kingdom-based senior leader of the Egyptian Muslim Brotherhood and Secretary General of the Muslim Brotherhood General Secretariat. The other three — Khuldun Khamis Zakaria Alden, listed as owner, and shareholders Zaid Issam Ahmed Al-Jebouri and Abdullah Issam Ahmad Al-Jebouri — are Türkiye-based and were designated in connection with one company, El-Kahira for General Trading. The two Al-Jebouris were listed, in Treasury’s wording, “for owning or controlling, directly or indirectly, El-Kahira for General Trading.” Treasury also says al-Abyari supported fundraising for Filistin Vakfi and Hayat Yolu, two entities OFAC had sanctioned previously. Both carry Turkish names.

No Turkish government response has been located in the week since. Anadolu Agency, the Turkish state wire, carried the action on 23 July as one line item in a broader same-day package that also covered nine entities and two individuals tied to the Cuban government and more than 50 individuals linked to a Mexican narco-terrorist organisation. Treasury’s release warns that foreign financial institutions conducting significant transactions for the designated parties risk secondary sanctions, including loss of access to the US financial system — the clause that bears on Turkish banks rather than on the three men. Secretary Scott Bessent said only that “the Trump Administration will relentlessly pursue terrorists and those who finance them.” Two of the three designated entities are described by Treasury as “sham charities tied to the Muslim Brotherhood”; neither has been named in any secondary account retrieved.

Assessment: The geography of a designation tells you which government is being asked to act. On the arithmetic, this one asks Ankara — three of four individuals, the only named company, and the two prior listings al-Abyari is accused of fundraising for. Yet the week’s commentary has been about London, because a secretary general is a better headline than a trading firm. Distrust any account of the network’s reach until the SDN entries are published: two of three entities remain unnamed, and the one claim circulating about an Indonesian node rests on a single partisan site. Silence from Ankara is not neutrality; it is the cheapest available response while the secondary-sanctions clause remains untested.

Sources: US Treasury — Treasury Disrupts Muslim Brotherhood and Hamas Financial Networks · State Department — Dismantling Muslim Brotherhood and Hamas Financial Networks · Anadolu/A News — same-day package covering Cuban entities, Brotherhood financiers and cartel leadership · Steptoe — Weekly Sanctions Update, 27 July 2026, logging the designations as alleged · The National — US moves to disrupt Muslim Brotherhood and Hamas financial networks

One Ban, Many Motions

Europe Has Passed Resolutions on the Brotherhood for Two Years and Banned It Once, in 2021

France, the Netherlands and Britain have produced votes, reviews and polling. Austria is the only European state with an actual prohibition — and the sanctioned secretary general’s nationality is still unresolved.

Austria banned the Muslim Brotherhood through anti-terrorism legislation adopted by its parliament on 8 July 2021, a fact recorded in a European Parliament written question that year. Nothing since has matched it. The French Senate adopted anti-entryism legislation on 5 May 2026 by 208 votes to 124, following a non-binding National Assembly resolution on 22 January 2026 labelling the Brotherhood a terrorist organisation, which La France Insoumise opposed. The Dutch House of Representatives narrowly approved a motion for a ban on the Brotherhood and “affiliated organisations” on 17–18 March 2026, introduced by Party for Freedom members; Brussels Signal reported that the AIVD does not currently classify the Brotherhood as a structured organisation in the Netherlands, which leaves the motion without an object to prohibit.

Britain remains where the 2015 review left it. Sir John Jenkins concluded that aspects of Brotherhood ideology were “contrary to British values” and that the “Brotherhood is a possible indicator of extremism,” but did not recommend proscription. In December 2025 Keir Starmer told Jewish News a ban was under “very close review.” Jewish News noted on 24 July that the organisation “is not banned in the UK.” No Home Office statement, OFSI listing, ministerial comment or Charity Commission action has been located since the designation. The most-quoted British figure of the summer — 54 per cent support for a ban — comes from a JL Partners poll of 2,000 adults commissioned by the campaign group Muslims Against Antisemitism and Christianphobia, and rose only after respondents were shown findings from the government review.

Assessment: The nationality question is not pedantry. GB News describes al-Abyari as an Egyptian-Austrian dual national resident in London; the Foundation for Defense of Democracies, an advocacy institute with a declared position, calls him Egyptian. If the Austrian element holds, Washington has sanctioned a citizen of the one European state that already bans the movement, and the enforcement gap sits inside the EU rather than across the Channel. Until the SDN entry is read, neither version should be repeated. The wider pattern is the desk’s recurring one: designation is fast and declaratory, prohibition is slow and evidentiary, and legislatures reach for the first when they cannot deliver the second. Steptoe’s compliance note still says “alleged” throughout.

Sources: European Parliament — written question E-003684/2021 recording Austria’s July 2021 ban · Brussels Signal — Dutch parliament passes motion for ban; AIVD does not classify the group as structured · Jewish News — London-based Brotherhood official sanctioned; group not banned in the UK · The National — Muslim Brotherhood under ‘close review' for UK ban · GB News — JL Partners poll commissioned by Muslims Against Antisemitism and Christianphobia · FDD — Treasury Extends Its Muslim Brotherhood Campaign to Europe

Western Media Watch

How NYT, WaPo, FT, BBC and the wires frame the region — what is emphasized, what is omitted, and what the gap reveals.

One Event, Two Frames

CENTCOM Says It Shot Down Every Missile, and Only AP Puts the American Strike in the Headline

The joint US–Saudi strike on Iraqi territory was the one act in Tuesday’s sequence that indisputably landed. It is missing from most headlines, and Baghdad has no speaker in any version.

US Central Command said that at 5:45 p.m. ET on 28 July, Islamic Revolutionary Guard Corps forces “launched multiple ballistic missiles from Iran in an attempted surprise attack on U.S. forces based in the Middle East,” that “all Iranian missiles were successfully intercepted,” and that American forces “remain vigilant and at a high state of readiness.” Hours earlier Donald Trump had met Benjamin Netanyahu at the White House, their first in-person meeting since the war began. Separately, US forces struck sites in Iraq used by Iran-aligned militias, an operation Saudi Arabia’s Defence Ministry says it took part in. The Associated Press was the only outlet in the retrieved set whose headline contained an American offensive act: “US thwarts Iranian missile attack and launches strikes with Saudi Arabia against militias in Iraq.” Bloomberg ran “US Intercepts Iran Attack on Bases, Puncturing Days of Calm.”

The launch and the interception rest on the CENTCOM statement alone; no independent confirmation of the number of missiles, the target or the outcome appeared in the window. The details that were reported came from reporters, not the command. CENTCOM said only “U.S. forces based in the Middle East,” unlocated; Axios placed the base in Jordan, and The Hill carried that as “Axios reported the base was in Jordan.” The Hill also noted that “CNN reported four ballistic missiles were fired.” The Jerusalem Post’s live blog said bases, plural, and added a vector absent from US coverage: “Iran fires missiles at US bases in Middle East following launches from Iraq towards Saudi Arabia.” CBC, PBS, Scripps, Fox and ABC kept the attribution inside the headline — “U.S. says,” “U.S. military says,” “CENTCOM says.”

Assessment: The interception frame is a defensive frame, and defensive frames close the question of escalation before it opens. Note what the desk cannot check and what it can. It cannot check the barrage; it can check that the strike on Iraqi territory, confirmed by two governments, produced no Iraqi casualty figure, no Iraqi ministry reaction and no Iraqi voice anywhere in the set. That is not a sourcing gap, it is an editorial one — Iraq is treated as terrain. Watch whether an Iraqi number surfaces late, as it did after El Obeid and Bara, and whether anyone rewrites the day’s headlines when it does.

Sources: AP (via American Press) — US thwarts Iranian missile attack and launches strikes with Saudi Arabia in Iraq · Bloomberg — US Intercepts Iran Attack on Bases, Puncturing Days of Calm · Axios — Iran launches missiles at U.S. base for first time since Trump paused strikes · The Hill — Iran launches ‘surprise' missile attack on U.S. base in Middle East · CBC — After days of calm, U.S. says it intercepted Iranian missile attack · Jerusalem Post live blog — Iran fires missiles at US bases following launches from Iraq towards Saudi Arabia

From Post to Wire

A New York Post Item With One Anonymous Source Became a Reuters Story About Trump’s Temper

An Israeli-sourced claim about Iranian nuclear construction at Pickaxe Mountain moved through two wires in a day. Nobody in the retrieved coverage asked whether it was true.

The New York Post reported on Monday, citing a source in Jerusalem, that Netanyahu was expected to give Trump intelligence that Iran is building up its nuclear facilities at Pickaxe Mountain and is lying about wanting a peace deal — one outlet, one unnamed source, in the Israeli prime minister’s own capital. By 1:03 a.m. on 28 July Reuters had it under the headline “Trump Shows Irritation With Netanyahu Before White House Talks on Iran,” reporting that Trump complained the talking points had surfaced publicly and, asked about Pickaxe Mountain, said: “I don’t need Bibi to tell me that.” At 8:35 a.m. ET the AP carried the same underlying claim from its own source, disclosing that Netanyahu “plans to share with Trump Israeli intelligence on Tehran’s nuclear program, according to a person familiar with Netanyahu’s visit, who spoke on the condition of anonymity because they were not authorized to speak to the media.”

The URLs record the day’s second pattern. Reuters' slug is scheduling-neutral — trump-to-host-netanyahu-zelenskiy-as-ukraine-iran-wars-reach-critical-stages — under a personality headline. Bloomberg’s slug reads us-dials-back-iran-threats under “US Intercepts Iran Attack on Bases.” ABC’s reads iran-live-updates-tehran-progress-made-strait-hormuz under “US intercepts Iranian missiles in ‘attempted surprise attack,' CENTCOM says.” In each case the morning frame was diplomacy and the evening frame was attack, on an unchanged address. (The slug-headline mismatch is inference from the URLs, not an editor’s statement.) The Washington Post filed its own piece — “Netanyahu heads to Washington as differences with Trump over Iran grow,” deck: “growing frustration in the Oval Office” — to /politics/, not /world/.

Assessment: The mechanism is worth naming because it is repeatable: a contested intelligence assertion travels as the setting for a story about mood, and arrives unexamined because it was never the subject. No IAEA position, no question of who gains from the leak, no test of the Pickaxe Mountain claim appears anywhere retrieved. Meanwhile the Israeli readout called the meeting “positive, productive” while Western copy called it strain, and neither side produced a document. Discount both. And keep the Gulf ledger open: Araghchi phoned Muscat and Riyadh about Hormuz, then Riyadh flew with CENTCOM inside the same 48 hours, and no headline in the set was about Omani or Saudi agency.

Sources: Reuters (via US News) — Trump Shows Irritation With Netanyahu Before White House Talks on Iran · AP (via Spectrum Local News) — Netanyahu-Trump meeting, first since Iran war began · Washington Post — Netanyahu heads to Washington as differences with Trump over Iran grow · ABC News — US intercepts Iranian missiles in ‘attempted surprise attack,' CENTCOM says · Al Jazeera — Trump expresses frustration with Netanyahu before White House meeting · Jerusalem Post — Netanyahu, Trump conclude ‘positive, productive' meeting at White House

Israel Press Review

Reading Haaretz, Times of Israel, Ynet and the Hebrew press — what Israeli media and officials are actually saying.

One Quote, Three Wordings

Trump Tells Fox He Does Not Need Netanyahu’s Intelligence, Hours Before the Oval Office Sit-Down

The New York Post reported the prime minister was bringing evidence on Iran’s Pickaxe Mountain site. Trump pre-empted it on air, and the only account of what the meeting produced is Netanyahu’s.

Netanyahu met Trump at the White House on Tuesday 28 July — the first meeting between them since the war began at the end of February, according to The Times of Israel, and Netanyahu’s seventh visit to the United States since Trump’s second inauguration, according to Haaretz. Hours earlier, responding on “Fox & Friends” to reports that Netanyahu would present intelligence on the Pickaxe Mountain site, Trump dismissed the exercise. “I don’t need Bibi to tell me that,” he said, in the wording carried by The Times of Israel and the Washington Times. “Bibi is telling me that because he wants me to stay involved.” Ynet reported him calling the site “not a big problem,” and reported separately that Israeli intelligence believes Iran has moved centrifuges there.

The line about satellite coverage exists in at least three non-identical published versions: the Washington Times has “the greatest cameras in the world,” Ynet has “the best cameras in the world,” and Political Wire, quoting the New York Post, has “We know exactly what’s going on. But no, I heard Bibi announce that.” No two renderings of a single televised sentence agree, which is a warning about how much of this cycle is being relayed rather than transcribed. Afterwards Trump wrote on Truth Social that it had been a “very good meeting” at which “many important subjects were discussed,” and posted three photographs. Ynet’s headline on Netanyahu’s own account read “No Pickaxe Mountain, no Turkey F-35s”; the prime minister said there had been no American demand for a withdrawal. Nothing American confirms any of those three claims.

Assessment: The structure matters more than the content. Netanyahu’s office briefs a dossier to an American tabloid; Trump answers the tabloid rather than the prime minister and says the briefing was designed to keep him in the war. Then the only inventory of American commitments — no Pickaxe strike file, no Turkish F-35s, no withdrawal demand — comes from the party that needs those commitments to exist before an October election. Read that list as an Israeli negotiating position stated as an outcome. Until a White House readout itemises anything beyond “important subjects,” the meeting produced one confirmed fact: the president said out loud that he is being managed.

Sources: The Times of Israel — Trump ahead of meet: I don’t need Bibi for intel on Pickaxe Mountain · Ynet — Netanyahu hails ‘excellent' Trump talks: no Pickaxe Mountain, no Turkey F-35s · Washington Times — Trump says he doesn’t need Israel’s help on Pickaxe Mountain · Political Wire — Trump rebukes Netanyahu ahead of Oval Office meeting (quoting the New York Post) · The Times of Israel — Liveblog, 29 July 2026 (Truth Social readout) · Haaretz — Trump and Netanyahu’s meetings: a trail of broken promises

Restraint, Said Out Loud

Katz Names Washington as the Reason Iran’s Refineries Are Still Standing, and Says It on Channel 14

The defence minister told a government-aligned broadcaster that Israel wants to hit Iranian energy targets and the United States will not approve it, citing oil prices and Iran’s neighbours.

Speaking Tuesday at Channel 14’s security conference, Israel Katz said: “We very much want to strike Iran’s energy targets, but the United States is not approving it at the moment because of concerns that Iran would attack neighboring countries and trigger a global oil crisis.” In the version carried by JNS and Matzav, he added: “We have struck Iran twice and are prepared to strike a third time on our own... The IDF has been instructed and is preparing accordingly to be capable of attacking Iran by itself,” and said Jerusalem would wait to see “what the United States does — whether it returns to the campaign or acts in other ways.” On American motives he was explicit: Washington “has interests in Iran that go beyond Israel’s specific concerns, including the Strait of Hormuz and global energy markets.” TASS carried a looser translation; the Israeli renderings are the ones to use.

The restraint Katz described has a subject. On Tuesday morning at 09:40, Jacob Magid reported for The Times of Israel that mediators believed a US–Iran breakthrough was near, with Iran and Oman having accepted a proposal to clarify Hormuz disagreements and revive a June memorandum of understanding — sourced entirely to unnamed mediators and unnamed sources, and to diplomats rather than governments. By Wednesday the same outlet’s liveblog headline read: “IRGC targets US forces in Jordan, as Iran rejects Omani plan to divide Hormuz between them.” In between, CENTCOM said it and the Saudi Arabian Armed Forces “conducted precision strikes in Iraq, July 28, against Iran-aligned terrorists” directed by the IRGC to attack US forces and Saudi energy infrastructure, and said it had intercepted multiple Iranian missiles fired at a US base in Jordan.

Assessment: A defence minister does not disclose an American veto by accident, and he does not disclose it on Channel 14 by accident either. The audience is domestic: Israel is willing, Washington is the brake, and the Knesset vote is due by 27 October with a Channel 12 poll on 27 July putting Netanyahu and Gadi Eisenkot level at 38 percent each as preferred prime minister — a figure published without sample size or field dates. Note also what Katz concedes: the American interest he names is Hormuz and oil, not Iran’s programme. The tell is the reversal. Mediator optimism at breakfast and a rejection headline a day later is the signature of leverage being briefed, not diplomacy being reported.

Sources: The Times of Israel — Katz says Israel ‘very much wants' to strike Iran, US not approving it · JNS — Katz: Israel wants to hit Iranian energy targets, US not approving · Matzav — Katz: Israel wants to hit Iranian energy targets, US not approving · The Times of Israel — Liveblog, 29 July 2026 (Iran rejects Omani Hormuz plan) · Haaretz — Liveblog, 28 July 2026 (CENTCOM statement on joint strikes with Saudi forces) · Al Jazeera — Liveblog, 27 July: Iran halts retaliatory strikes after pause in US attacks

Digital Front Monitor

Cyber operations, information warfare and the infrastructure of control across the region.

Four spoke, the rest did not

Share of the minimum 30 Minnesota water systems whose operators disclosed publicly

Minnesota IT Services count of "more than 30" systems, 26–27 July 2026; four cities self-disclosed

Thirty Systems, Four Statements

Minnesota Confirms Coordinated Intrusion at Thirty-Plus Water Systems and Names No One

State IT officials say operational technology at more than thirty community water utilities was targeted over two days, with no boil-water advisories and no attribution by any party. Four cities have spoken publicly; the rest have not.

Minnesota IT Services confirmed on Tuesday that a “coordinated cyberattack” targeted more than 30 community water systems between Sunday, July 26 and Monday, July 27. Four cities — Plymouth, South St. Paul, Maple Plain and Braham — disclosed the intrusions publicly on Monday, a day ahead of the state’s own account. Federal and state investigators say the activity was directed at operational technology, the control layer that runs pumps and treatment processes, rather than at billing or administrative IT. The Minnesota Department of Health said it was not aware of any municipality asking residents to alter their drinking water use, and all four cities described impacts as limited or mitigated. John Israel, the state’s chief information security officer, said MNIT was “working side by side with our partners to share intelligence, support affected communities, and help utilities restore operations safely,” adding that the incident “demonstrates why Minnesota has invested in strong cybersecurity capabilities and partnerships.”

No party has attributed the intrusions. MNIT spokesperson Emily Zimmer told Reuters by email that while the investigation continues, “the timing, methods of access, and targeted infrastructure share characteristics with other coordinated cyber incidents our federal partners have observed involving critical infrastructure,” and said the agency could not yet discuss formal attribution or specifics. Zimmer said the word “attack” was used “because investigators identified unauthorized access with malicious intent directed at these systems.” The FBI said it was aware of the incident and in contact with victims “to resolve the matter.” CISA did not respond to Reuters; officials at CISA and the EPA were not immediately available. Reuters framed the intrusions comparatively, noting similarity to earlier waves against US water infrastructure that officials have previously attributed to Iranian-affiliated hackers.

Assessment: Two things in the official record are doing quiet work. The health department’s line is the absence of municipal requests, not an affirmative finding that no process was manipulated — a weaker statement than it reads as. And Zimmer’s sentence about shared “characteristics” is built to license an inference the state declines to make itself; that is a courtesy to the wires, not evidence. The disclosure gap is the number to hold onto: more than thirty systems touched, four willing to say so. Note also what is missing. Nobody has claimed this. In a register where hacktivist brands routinely claim access they never had, silence from a claimant is the anomaly — and any claim arriving now, after public disclosure, is cheap to make and should be read as marketing until proven otherwise.

Sources: FOX 9 Minneapolis–St. Paul — 30 Minnesota water systems targeted · Cybersecurity Dive — authorities investigating coordinated cyberattack on Minnesota water · KFGO (Reuters copy) — MNIT discloses incident at more than 30 local water systems, Zimmer email · KIMT — cyberattack hits 30 Minnesota community water systems · MinneapoliMedia editorial — no public attribution has been made by any city, state or federal investigator

A Comparison, Not a Finding

The Advisory Everyone Is Citing Was Updated Four Days Before Minnesota Was Touched

CISA’s AA26-097A, refreshed on July 22, names specific Rockwell, Schneider and Siemens controllers. No one has said whether any of the Minnesota utilities ran them — which is the difference between a pattern and a link.

The advisory being pulled into this week’s coverage is not new. AA26-097A was published on April 7, 2026 to document tactics and indicators tied to what the authoring agencies describe as ongoing exploitation of internet-connected OT devices by Iranian-affiliated APT actors. The July 22 update added guidance on detecting malicious changes in reusable code modules inside Rockwell Automation PLC programs and widened the manufacturer scope to include observed targeting of Schneider Electric, Siemens and potentially other branded controllers. WaterISAC’s member note names models: Rockwell CompactLogix and Micro850, Schneider BMX P34 and Modicon M340, Siemens S7-1200. The update also adds MITRE technique T1041, describing use of vendor configuration software on leased infrastructure to steal project files, plus fresh July indicators for log review. WaterISAC’s instruction to utilities and integrators is blunt: remove PLCs from direct internet exposure behind a secure gateway and firewall.

The reported technique is the use of the vendors' own engineering software — Studio 5000, EcoStruxure Control Expert, TIA Portal — to reach controllers over the internet; that account, including the claim that operators were shown falsified sensor readings, comes from a secondary aggregator and should be read off the CISA PDF before it is repeated. One durable detail: Rockwell has confirmed that CVE-2021-22681 cannot be fully resolved by patch, because the weakness lies in how the cryptographic key authenticating Studio 5000 to Logix controller communications is protected. Against that, a researcher quoted by Cybernews in April said threat groups have made “hundreds of unverified claims of compromised OT devices worldwide, including in North America” with no corresponding public disclosures, and that posting control-system screenshots without access is routine. Minnesota inverts that shape entirely.

Assessment: The recirculation is the story here. An advisory updated on July 22 is being read as evidence about an event that began on July 26, and the two connect only through the word “characteristics” in a state spokesperson’s email. AA26-097A is manufacturer-scoped, not incident-scoped; it tells you which controllers are exposed, not who touched Braham. The threshold to watch is narrow and concrete: a city or MNIT naming a Rockwell, Schneider or Siemens device on the affected systems. Absent that, the honest frame is comparison. Note too that the unpatchable-by-design element pushes the remedy toward architecture and procurement budgets in towns of a few thousand people — which is a municipal finance story wearing a geopolitical costume.

Sources: CISA — advisory AA26-097A, published 7 April, updated 22 July 2026 · CISA — AA26-097A full advisory PDF · WaterISAC — member note on the updated PLC targeting advisory, named models and T1041 · TechTimes (secondary aggregator) — engineering-software technique and Rockwell CVE-2021-22681 · Cybernews — hundreds of unverified OT compromise claims, no public disclosures · 1898 & Co. advisory summary — July 2026 update on PLC targeting

Watch Tomorrow — The Files' Forward Radar

Iran File: Whether the Iraqi government issues any statement on strikes against PMF headquarters on its territory, and whether Baghdad or the IRGC puts a figure of its own against the PMF’s eight dead.
Sahel Monitor: Whether any AES defence ministry publishes a document, budget line or basing detail behind Tiani’s 18,000 figure, rather than leaving it as an RTN interview.
The Red Sea: Whether WFP or OCHA issues a re-measurement of El Obeid’s population now the Omdurman–El Obeid road is claimed open, and whether Britain’s call to add El Obeid to the arms-embargo resolution appears in a Security Council draft.
Brotherhood Brief: Whether Ankara says anything about El-Kahira for General Trading, and whether the OFAC SDN update for 23 July names the two entities Treasury described only as sham charities.
Western Media Watch: Whether any Western outlet publishes a headline on the Iraq strikes that contains an Iraqi speaker or an Iraqi casualty figure not sourced to the PMF.
Israel Press Review: Whether Katz repeats outside Channel 14 that Washington is withholding approval for strikes on Iranian energy, and whether Calcalist’s interceptor and munitions figures are confirmed with numbers attached.
Digital Front: Whether CISA, the FBI or the EPA says anything on the record about attribution in Minnesota, and whether any of the affected utilities confirms a Rockwell, Schneider or Siemens PLC of the kind named in advisory AA26-097A.