Daily Edition No. 16Thursday, July 30, 2026 · Updated 12:00 Gulf · 𝕏 @mefilesnews · Instagram @mefiles.news · Facebook

Seven files · One region · Zero illusions
@mefilesnews @mefiles.news Facebook
Iran File — Lead

The Only Map of Washington’s Heavy Wave Came From Iranian State Media, and It Points at the Coast

CENTCOM says it completed a “heavy wave of strikes” on dozens of IRGC targets at 10 p.m. Eastern Wednesday — five in the morning Gulf time on Thursday. It named no locations. The single account of where the ordnance fell is Iranian state media, relayed by CNN, and it names Bandar Abbas and Kish: the chokepoint city and an island inside the Gulf. On the command’s own accounting of its target categories, and on the market’s pricing of the week, this remains a war about a waterway.

Brent's eight-day round trip
Brent crude at three CNN print times, 23 to 29 July 2026 — one publisher, one benchmark
$10023 Jul$91.3026 Jul$86.8229 Jul
CNN live coverage, 23, 26 and 29 July 2026

The sequence began at 5:45 p.m. Eastern on Tuesday — 00:45 Gulf time Wednesday, a dawn event for readers here — when CENTCOM said Islamic Revolutionary Guard Corps forces had fired multiple ballistic missiles from Iran in what it called “an attempted surprise attack on US forces based in the Middle East.” CENTCOM said all the missiles were successfully intercepted and gave no target locations. Iran’s IRGC, in a statement carried by state broadcaster Press TV, said it had struck US military targets in Jordan. On Wednesday President Trump told a Fox News reporter, “We’ll be hitting them hard. They’re going to get a beating,” and CNN’s live page headlined him saying it was “our turn.” The reply landed at 10 p.m. Eastern Wednesday, which is 05:00 Gulf time Thursday. CENTCOM said it had completed “a heavy wave of strikes” against dozens of IRGC targets and described the operation as a “powerful response.” The only imagery is CENTCOM-supplied and, as ABC News noted in its own caption, undated. Neither the hundred-per-cent interception rate nor the target count has been independently verified by anyone.

CENTCOM again named nothing. The single account of where the strikes fell comes from Iranian state media, relayed by CNN: explosions heard across southern Iran, “including Bandar Abbas and the Persian Gulf island of Kish.” That is a claim by the party that was struck and should be read as one. It is also consistent with what the American command has said about its own targeting. On 20 July CENTCOM described hitting “Iranian military command centers, maritime capabilities, missile” sites — the same categories, in the same order. Bandar Abbas is the IRGC Navy’s principal base and the city that sits on the chokepoint; Kish lies inside the Gulf, well away from the enrichment programme. CNN reported on 9 July that the United States had been “deliberately striking and then pausing.” Thursday morning’s wave is the loudest instance of an established rhythm rather than a break in it. Nothing in the target set as either side has described it points at the nuclear file.

What has changed is who else is shooting, and what is burning on the Arab side of the water. Saudi Arabia’s defence ministry said late Tuesday its air defences had intercepted and destroyed several drones aimed at oil installations in the Eastern Province for a second consecutive day, blaming Iran-aligned groups in Iraq; the spokesman, Turki al-Maliki, said the attempts were thwarted. A Copernicus Sentinel-2 satellite image dated Monday 27 July, captioned in New York Times reporting syndicated by the San Juan Daily Star, shows smoke rising from an oil facility at Abqaiq. A screengrab verified by AFPTV shows smoke over the Aramco refinery at Jizan on 25 July — Red Sea coast, not Gulf coast. Interception and impact are not mutually exclusive; debris falls. But the ministry’s account and the imagery are two accounts, and the gap should not be smoothed over. Early Wednesday Riyadh said it had struck Iran-backed targets inside Iraq jointly with US forces while “not seeking escalation.” CENTCOM cited “over 30 IRGC-directed aerial drone attacks in the last 72 hours.” Iraq’s Popular Mobilisation Forces said at least 20 of its members were killed and 32 wounded.

The market is pricing the waterway rather than the war. Brent touched $100 on 23 July, after Houthi forces targeted Saudi shipping in the Red Sea, its first three-figure print since May. CNN had it down 5.7 per cent to about $91.30 on 26 July, then up 5.8 per cent to $86.82 on Wednesday morning; Bloomberg put it near $90 early Thursday after a rally of almost 8 per cent in the previous session. That is a round trip of roughly thirteen dollars in eight days, and it arrives in a different instrument and timestamp in nearly every publisher’s copy — futures in one, contracts-for-difference in another. Equities barely registered any of it: Dow futures off 330 points, or 0.6 per cent, with S&P 500 and Nasdaq 100 futures each down about 0.1 per cent. The campaign’s own high-water mark, $120.88 intraday, was set on 30 April, three months ago today.

Assessment: Read the campaign from where the ordnance lands and it has not moved in ten days: maritime capability, coastal bases, logistics. That makes the American objective the reopening of a strait rather than the dismantling of a programme, and it makes Riyadh’s crossing from interceptor to co-belligerent the structural change of the week, because it converts a bilateral exchange into a Gulf coalition action and gives Tehran’s drone campaign against Saudi energy exactly the political return it was seeking. Distrust, in order: a hundred-per-cent interception rate claimed by the side doing the intercepting; a casualty figure supplied by the side that was struck; a strike map supplied by the state that was hit; and a drone count that exists only inside the sentence justifying the strike. One aggregator headline says Trump is weighing another two-week campaign. The Files could not trace it to an originating wire and does not treat it as reported — though if it holds, it is incompatible with any shipping track. Note too that al-Maliki is a brigadier general in one outlet and a major general in another, unresolved.

The Cartoon — July 30
HORMUZ
No, I don’t know what they hit either. But the toll went up, so it must have been near the water.”
MEFILES · the cartoon · CENTCOM named no locations for Thursday’s strikes; Iranian state media placed them at Bandar Abbas and Kish
$120.88
Brent’s 52-week intraday high, set on 30 April — three months ago today, and still the campaign’s price ceiling
Forbes Advisor oil prices page, as of 29 July 2026
4
unnamed sources — two Nyala eyewitnesses and two member states — carrying the UN Panel draft on RSF night flights
Reuters, reviewing a draft report due for publication in September 2026
7
designations in Treasury’s 23 July Brotherhood action, spread across the UK, Türkiye, Indonesia and Gaza
US Treasury press release SB0572, 23 July 2026
16 min
between Times of Israel’s “reportedly launching airstrikes” and “US confirms striking Iran” on Thursday morning
Times of Israel liveblog entries, 02:16 and 02:32 Israel time, 30 July
30+
Minnesota community water systems confirmed hit, with no boil-water advisories and no attacker named by any US agency
Minnesota IT Services, on the record to The Hacker News and BleepingComputer

Iran File

The regime, the IRGC, the proxies, the strait — read from the Gulf, not from Washington.
Escalation for Escalation

CENTCOM’s Reply Fell on Bandar Abbas and Kish at Five in the Morning Gulf Time

The IRGC fired at American forces in Jordan on Wednesday’s Gulf dawn; the American “heavy wave” landed on the choke-point coast twenty-eight hours later. The target set says the war is still about the waterway.

CENTCOM said that at 5:45 p.m. ET Tuesday — 00:45 GST Wednesday, a Gulf-dawn event — “Islamic Revolutionary Guard Corps forces launched multiple ballistic missiles from Iran in an attempted surprise attack on US forces based in the Middle East,” adding that “all Iranian missiles were successfully intercepted.” It named no target locations. The IRGC did: Press TV reported the Guard saying it had struck American military targets in Jordan. Trump told a Fox News reporter on Wednesday, “We’ll be hitting them hard. They’re going to get a beating,” and told CNN’s cameras it was “our turn.” CENTCOM then said it completed a “heavy wave” of strikes at 10 p.m. ET Wednesday — 05:00 GST Thursday — describing it as a “powerful response.” The Times of Israel and ABC News both put the count at dozens of IRGC targets.

Where the weight fell matters more than how much of it there was. Iranian state media, cited by CNN, reported explosions across southern Iran including Bandar Abbas and the Persian Gulf island of Kish — the IRGC Navy’s principal base and an island inside the Gulf, not Tehran and not nuclear infrastructure. The imagery released to accompany the strikes was, by ABC’s own caption, undated handout video footage from CENTCOM; it is not verified footage. Nor has the 100 percent interception rate been independently checked. The categories are familiar: CENTCOM’s description of its 20 July round listed “Iranian military command centers, maritime capabilities, missile and” more of the same, and CNN reported on 9 July that Washington has been “deliberately striking and then pausing.”

Assessment: Read the target list, not the adjectives. “Heavy wave” is a press-release word; Bandar Abbas and Kish are a strategy. Three weeks of American strikes have concentrated on maritime and missile capability, which means the campaign’s object remains the Strait rather than the enrichment programme — and that the shipping track, not the nuclear track, is where a settlement would show up first. Two cautions. Al Jazeera filed Wednesday under “US accuses IRGC”; the IRGC’s own Press TV statement makes that hedge the weaker call. And an aggregator line that Trump is weighing a further two-week campaign has no traceable originating wire. If it firms up, it is the most important sentence of the week.

Smoke at Abqaiq

Riyadh Says It Intercepted the Drones, and a Copernicus Satellite Shows an Oil Facility Burning

Saudi Arabia’s defence ministry reported drones destroyed over the Eastern Province on Monday and Tuesday. A Sentinel-2 image from Monday shows smoke rising at Abqaiq. Both statements cannot be smoothed into one.

Defence ministry spokesman Turki al-Maliki said Saudi “aerial defenses intercepted and destroyed several drones that attempted to target oil installations” in the east, blaming Iran-backed groups in Iraq for a second consecutive day, according to Türkiye Today. The New York Times, reporting the Monday wave under Ismaeel Naar’s byline, said the ministry named petroleum facilities in the Eastern Province and Riyadh regions and called the launches “terrorist attempts” from Iraqi territory. The same NYT report carries a Copernicus Sentinel-2 satellite image captioned as smoke rising from an oil facility in Abqaiq on Monday 27 July — the same installation struck in 2019, and the strongest piece of independently verifiable physical evidence on the file. Interception and impact are not mutually exclusive; falling debris burns too. But the ministry has not reconciled them, and no one has asked it to.

A second site was hit from the opposite coast. Al Jazeera published an AFPTV-verified screengrab from undated user video, dated 25 July, showing smoke over the Aramco refinery at Jizan on the Red Sea. Abqaiq faces the Gulf; Jizan faces Yemen. Riyadh answered early Wednesday: the defence ministry said on social media it had struck Iran-backed targets in Iraq, that it was “not seeking escalation, but will respond to aggression,” and that the operation was conducted jointly with US forces. CENTCOM described the targets as “multiple terrorist logistics and weapons sites” in eastern Iraq. Iraq’s Popular Mobilisation Forces said at least 20 of its members were killed and 32 wounded — a figure claimed by the target and not independently confirmed. Al-Maliki’s rank is given as Brigadier General by Türkiye Today and Major General by Arab News.

Oil has priced the two-front problem rather than the strike totals. CNN had Brent up 5.8 percent to $86.82 on Wednesday morning with US crude at $84.30; Bloomberg had Brent near $90 early Thursday after an almost 8 percent session. Forbes Advisor’s series puts the 52-week intraday high at $120.88, printed on 30 April — three months ago to the day — against a low of $58.66 last December. CNN reported the market touching $100 on 23 July after Houthi attacks on Saudi ships; Trading Economics has Brent at $87.53 on 28 July, up 18.43 percent on the month. Dow futures, meanwhile, were off 330 points, or 0.6 percent.

Assessment: The Saudi shift from interception to joint strike is the week’s real structural change, and it is being under-reported because it happened inside Iraq rather than inside Iran. A state that bombs Iran-aligned formations alongside CENTCOM is no longer available as a broker, which closes the channel Tehran was using days ago. Two things to distrust: PMF casualty figures, which are self-reported by the bombed party, and any single Brent series. The five published prints for 28–30 July are different instruments at different timestamps and do not reconcile. The volatility — $100 to $87.53 to $90 inside a week — is the signal; the level is not.

Sudan Crisis Monitor

SAF versus RSF, the sieges and the famine, the gold economy, and the diplomacy of press releases.
One strike, five death tolls
Reported deaths in the 18 March 2026 drone strike at Tiné, eastern Chad, by publisher
OHCHRat least 24Sudan War Monitor20MSF / Chadian authorities17Middle East Monitor17Dabangaat least 16
OHCHR, Sudan War Monitor, MSF (citing Chadian authorities), Middle East Monitor, Dabanga
Sudan's gold left the UAE
Official Sudanese gold shipments to the United Arab Emirates, 2024 against 2025
Tonnes shipped to the UAE22.2t in 20248.2t in 2025
Bloomberg, 2 April 2026, citing data shared by Sudan's central bank
Corridor on Paper

A UN Draft Puts Fighters, Drones and Night Flights Into Nyala on Four Unnamed Sources

Reuters says it has reviewed a draft UN Panel of Experts report finding that Boeing 727s flew RSF fighters and weapons from N’Djamena into Darfur. The document is confirmed; the allegation inside it rests on two eyewitnesses and two member states, none of them named.

Reuters reported on 29 July, dateline London and Cairo, that it had reviewed a draft report by the UN Panel of Experts on the Sudan — the body the Security Council mandated to monitor the Darfur arms embargo imposed in 2004 — which finds that Boeing 727s previously linked by Reuters to a US military contractor’s business network carried mercenaries, weapons and drones for the Rapid Support Forces. The draft states that the RSF “utilized the N’Djamena-Nyala air corridor to transport fighters, foreign mercenaries, and military equipment, including drones and weapons, into Darfur,” and that between January and July 2026 multiple 727s and some Ilyushin Il-76 transports landed at night at Nyala, the RSF’s main military and logistics hub. The report is due for publication in September, which means the text can still change.

The Panel’s own account of its evidence is narrow. It says it “received reliable information from four sources that the aircraft had transported RSF fighters and mercenaries, as well as military equipment, including drones and weapons” — two eyewitnesses in Nyala and communications from two member states, none of the four identified. It logged no movement by the three aircraft since they arrived in N’Djamena and said it suspected they took “deliberate steps to avoid detection while in flight,” without supplying detail for that suspicion. Reuters' earlier tracking, built on satellite imagery, mobile phone data and one open-source video, found no record of the flights on independent ADS-B trackers. Chad’s foreign minister, Abdoulaye Sabre Fadoul, has said questions about the aircraft are covered by defence secrecy and that Chad’s involvement in Sudan’s war runs only through “diplomatic efforts to restore peace.” The RSF did not respond to Reuters' requests for comment.

Assessment: What is established today is that a document exists and says these things. That is not the same as an established flight. Panel of Experts findings routinely rest partly on material handed over by governments, and governments in this war have positions: two of the four sources here are member states whose identities are withheld, which is precisely the seam where an interested capital can place a finding it could not place under its own name. Read the September text, not the July leak. The more durable point is structural: the sanctions record already runs at both belligerents and both supply chains, and OFAC’s 17 April action against Colombian-recruitment networks sits directly on this strand.

Two Replies, One Refusal

Both Belligerents Have Now Answered Boulos, and Both Answers Turn on Who Leaves a City First

The RSF accepts a truce but refuses to withdraw from captured territory. Burhan will not accept a truce that is not preceded by that withdrawal. The American paper is on the table and neither reply moves an inch of ground.

Sudan Tribune reported on 14 July that the RSF had submitted its response to the peace proposals carried by Massad Boulos, the US Senior Advisor for Arab and African Affairs: the force accepts a truce, sets conditions for a political settlement, and rejects withdrawal from the territory it holds. Sudan’s Security and Defence Council, chaired by Abdel Fattah al-Burhan, said on 12 July that it had filed its own answer. Burhan’s position has not shifted since January — no truce before RSF withdrawal from cities, and no mediating role for the United Arab Emirates. Burhan met Eritrean President Isaias Afwerki in Asmara on 17 July for lengthy talks dominated by ceasefire proposals, and repeated the sequencing condition there; Mada Masr’s Sudan Nashra of 25 July reports Afwerki reinforced it.

Mada Masr, which has good Sudan sourcing but is here the only outlet reporting it, also describes an existing Burhan–Hemedti channel and says Burhan is accelerating a state-led dialogue plan while forces prepare for a possible battle over Tina. The International Crisis Group’s 24 April briefing sets the ceiling on all of this: Hemedti accepted the Quad peace plan in November 2025 a day after Burhan openly rejected it; key Burhan allies oppose any humanitarian truce and treat the UAE as a party rather than a mediator; and the Quad roadmap, in Crisis Group’s words, “has yet to get off the ground.” Its evidence for the pro-army position is telephone interviews with Darfuri armed group leaders, National Congress Party figures and pro-army party representatives conducted between September 2025 and January 2026.

Assessment: A response is not a concession. Both sides have now put paper in front of Washington while conceding the one thing that is not theirs to concede — territory — and that symmetry is what keeps the file alive without moving it. Treat the Burhan–Hemedti channel with care: single-outlet, and exactly the kind of claim both principals benefit from having circulate whether or not it is operating. Note also the sequencing between the desk’s two stories. The N’Djamena–Nyala corridor, as the UN draft describes it, ran through January to July — the same months in which the diplomacy was being drafted, exchanged and stalled.

The Brotherhood Brief

The organization as structure — designations, networks, finances, legal battles. Structure over slogans.
The designation architecture
US Muslim Brotherhood measures on the documentary record as of 30 July 2026
4
National chapters designated
3
OFAC financial actions in 2026
7
Designations on 23 July
4
Jurisdictions touched
US Department of State, 13 January and 9 March 2026; US Treasury SB0572
Drawing the Next Chapter

A Partisan Think Tank Puts Iraq on the Brotherhood Map Six Days After Treasury Sanctioned London

The Middle East Forum published a mapping piece this week arguing the Brotherhood is reorganising in Iraq — a country absent from Washington’s four designated chapters. The claim rests on one advocacy outlet and one meeting date.

The Middle East Forum, a Philadelphia-based research organisation with a declared adversarial position on the Muslim Brotherhood, published “The Muslim Brotherhood Reorganizes in Iraq” on or about 29 July. Its argument: the Iraqi Islamic Party historically served as the Brotherhood’s political arm in Iraq, lost much of its electoral weight after joining post-2003 governments, and its leaders subsequently moved into broader coalitions that did not publicly identify as Islamist. That “deliberate ambiguity,” the piece says, “now appears to be breaking down.” It cites a 15 July 2026 meeting of the State Administration Coalition and the appearance there of Mahmoud al-Qaisi. THE FILES was unable to retrieve the full text and is not reproducing the al-Qaisi detail beyond the fact that MEF asserts it.

Iraq appears nowhere in the American designation architecture. State designated the Lebanese, Jordanian and Egyptian branches on 13 January 2026 — the Lebanese chapter as both a Foreign Terrorist Organization and a Specially Designated Global Terrorist, along with its secretary general Muhammad Fawzi Taqqosh — and the Sudanese branch as an SDGT on 9 March, with FTO designation effective 16 March, citing “excessive violence against civilians.” Four chapters in seven months. The three OFAC financial actions of 2026, dated 21 January, 12 March and 23 July, reached the United Kingdom, Türkiye, Indonesia and Gaza. None reached Baghdad.

Assessment: Watch the direction of travel. In this file, the research sector has repeatedly published a country study before Washington acted on it, and the sequencing invites a lazy inference that the study caused the designation. It usually did not; both draw on the same small pool of Arabic-language analysts and the same Egyptian and Gulf briefings. What makes the Iraq item worth logging is not its evidence, which is one meeting and a contested attendance, but the fact that Iraq is where an American designation would collide with a government Washington still needs. That collision is the reason to expect the mapping to stay in the think tanks for a while.

Writing the Target List

A Washington Advocacy Group Names the Two Brotherhood Officials It Wants Sanctioned Next

The Foundation for Defense of Democracies argued on 24 July that Mahmoud al-Abyari “should not be the last Brotherhood official designated by Treasury,” and named the acting general guide and the movement’s spokesman as the next candidates.

The Foundation for Defense of Democracies, an openly hawkish Washington think tank, published “Treasury Extends Its Muslim Brotherhood Campaign to Europe” on 24 July, a day after OFAC designated four individuals and three entities under Executive Order 13224. The piece argues that al-Abyari — whom Treasury describes as a United Kingdom-based senior Egyptian Brotherhood leader and Secretary General of the Muslim Brotherhood General Secretariat — “should not be the last Brotherhood official designated by Treasury,” and names Acting General Guide Saleh Abdel Haq and spokesperson Osama Suleiman as the officials Washington should target next. Treasury’s own framing on 23 July was broader and vaguer: Secretary Scott Bessent said that “whether operating under the guise of charities, businesses, or underground financial networks, those who enable Hamas will be exposed, sanctioned, and held accountable.”

The same constituency is also filling in the parts of the action Treasury did not publish. FDD’s Long War Journal reported on 27 July that El-Kahira for General Trading, the designated Türkiye-based entity, transferred hundreds of thousands of dollars for Hamas, and that its owner and shareholders separately laundered funds for organised-crime networks including the Swedish network Foxtrot — attributing both claims to Treasury. Neither the dollar figure nor the Foxtrot link appears in the portions of press release SB0572 THE FILES retrieved, and neither should be treated as confirmed. What SB0572 does say is that the action “reflects close coordination with the Federal Bureau of Investigation, Drug Enforcement Administration, and Customs and Border Protection.” The DEA’s presence in a Brotherhood finance case is unusual.

In London, where al-Abyari resides, the Brotherhood remains legal and no government response to the designation had surfaced by 30 July. The standing British position was set out in a Lords exchange in January, when Lord Walney, a crossbench peer and former government extremism adviser, pressed for reassurance that ministers “recognise the threat that the Muslim Brotherhood and related organisations pose to this country.” Home Office minister Lord Flint replied that “a wide range of offences and powers can be used to counter the threat from extremism,” listing charity regulation, broadcasting, education and immigration powers alongside encouragement-of-terrorism and public-order offences. The New Statesman’s July reported feature named the Henry Jackson Society as leading the proscription campaign, and quoted an unnamed HJS researcher conceding that full proscription under the Terrorism Act 2000 “would likely affect individuals who were once members and have sought asylum here.”

Assessment: A published target list is not a policy document, but it is a useful instrument. It tells you which names the designation constituency believes are already documented enough to survive OFAC’s evidentiary review, and it puts pressure on Treasury by making inaction visible. Distrust the drift in the other direction: details that enter circulation as “Treasury said” without appearing in the release, of which the Foxtrot claim is this week’s example. The British silence is the more telling variable. Lord Flint’s answer describes a disruption toolkit built precisely so that proscription need never be decided, and an American sanction on a London resident is the first thing that makes that evasion costly.

Western Media Watch

How NYT, WaPo, FT, BBC and the wires frame the region — what is emphasized, what is omitted, and what the gap reveals.
One Sentence, Five Headlines

CENTCOM Wrote One Sentence About Eastern Iraq and Four American Outlets Built Their Headlines From It

The joint US–Saudi strikes that killed at least 20 Popular Mobilisation Forces members were reported through a single CENTCOM claim of “over 30 IRGC-directed aerial drone attacks” that no outlet independently verified.

CENTCOM and the Saudi Arabian Armed Forces announced early Wednesday that US and Saudi aircraft had struck sites in eastern Iraq late on Tuesday 28 July. The operative text, quoted verbatim by CNN, was one sentence: “US and Saudi fighter aircraft struck multiple terrorist logistics and weapons sites across eastern Iraq in a strong response to over 30 IRGC-directed aerial drone attacks in the last 72 hours.” That sentence carried the causation, the target characterisation and the only number offered in justification. Iraq’s Popular Mobilisation Forces said at least 20 of its members were killed and 32 wounded. CBS timestamped its account 29 July at 3:27 a.m. EDT. Nothing retrieved from any Western outlet in the following 48 hours independently confirmed the 30-attack figure or the 72-hour window.

The headline choices diverged on the same facts. CBS News ran “U.S. and Saudi Arabia strike Iran-backed groups in Iraq after attacks on American forces” — asserting the causal “after” flat in the headline while its own body text used the word “allegedly” about the targeting of American forces. NPR ran “Iran resumes missile attacks as U.S. and Saudis strike Tehran-backed militias in Iraq,” the only headline in the set making Iran the grammatical subject of the first clause and relegating the strike to a subordinate “as” — simultaneity rather than response. The Washington Post’s national security desk led on Trump: “Trump threatens to hit Iran ‘hard' after Saudis join in U.S. strikes on proxies.” Its URL slug still reads `us-says-it-shot-down-iranian-missiles-targeting-troops-middle-east`, preserving the headline the story was filed under before it was retitled around the threat.

Assessment: The buried item is Riyadh. CNN was the outlet that noted this is the first time Saudi Arabia has claimed responsibility for strikes inside Iraq since the war began, after months of absorbing attacks without military response. That is the change in the war’s structure; three of the five headlines treat it as a modifier — “Saudis join,” “U.S. and Saudis” — attached to a familiar American story. The Post’s second piece is the tell in the other direction: its slug ends in `disarmament`, which means the analytical frame arrived pre-set as an Iraqi domestic problem rather than a question about strikes on a state’s own security forces. Note also that the AP headline circulating on this event was retrieved only through a syndicated feed, not AP’s own site.

Datelined Beirut

The Only Photograph From Wednesday’s Strikes Was Taken in Mosul, Which Is Not in Eastern Iraq

CENTCOM said the targets were “across eastern Iraq.” The AP image the Washington Post ran showed a struck Popular Mobilisation Forces base in Mosul, and the analysis carrying it was filed from Beirut.

The Washington Post’s World desk published an analysis on 29 July headlined “Iraq’s balancing act is only getting harder as the war between the US and Iran widens,” with the dek: “U.S. and Saudi strikes against Iran-allied factions in Iraq have put the Iraqi government in a delicate position.” The piece was datelined Beirut. Its accompanying photograph was captioned: “Damaged structures at the site of an airstrike on a Popular Mobilization Forces base in Mosul, Iraq, Wednesday, July 29, 2026. (AP Photo/Farid Abdulwahed).” Mosul is in northern Iraq, not the eastern belt CENTCOM named. Nothing retrieved reconciles the geographic claim in the military statement with the location of the only image in circulation, and no outlet in the set flagged the discrepancy or published a target list of its own.

Assessment: Two possibilities, and the reporting does not let a reader choose between them: either the strikes ran considerably wider than CENTCOM’s “eastern Iraq” phrasing suggests, or the wire photographer reached a site that fell outside the announced operation. Either way the day’s visual record and the day’s official geography do not match, and the mismatch survived into print because the desks writing the analysis were not in the country. A Beirut dateline on an Iraq strike story is not a failing in itself — access is genuinely constrained — but it does mean the target set is being described from the statement outward rather than the ground up. Watch whether any outlet publishes coordinates.

Israel Press Review

Reading Haaretz, Times of Israel, Ynet and the Hebrew press — what Israeli media and officials are actually saying.
Who Owns the Record

No White House Readout, So One Anonymous Israeli Official Wrote the Oval Office Record

Netanyahu’s first in-person meeting with Trump since February produced no American account, no press access and no agreed length. Nearly everything known about what was said inside comes from the Prime Minister’s own side.

Netanyahu met Trump in the Oval Office on Tuesday 28 July, his first in-person meeting with the president since the Iran war began in February 2026. Reporters were kept out and the White House released no readout, describing the meeting only as “productive.” The Forward reports Netanyahu entered through the West Wing without cameras and that the photographs distributed afterwards came from his own Government Press Office; it puts the meeting at 80 minutes, while Axios’s Barak Ravid puts it at 90. Both figures rest on briefings. Netanyahu’s own account was superlative and unspecific: “one of the best meetings we’ve had,” he told Fox News, adding that “we have a shared goal, and it will be achieved, whether through diplomatic means or other means.” On exit, per The Forward, he offered one word: “Excellent.”

At 02:12 on Thursday, Times of Israel published the only substantive account of the room, sourced to a single anonymous senior Israeli official. That official says Netanyahu pushed no single Iran strategy, that the session was an “exchange of ideas” across three scenarios beginning with a diplomatic agreement, that he did not tell Trump which he preferred, and that he did acknowledge doubts Iran would uphold anything it signed. A separate PM’s aide briefing supplies three denials: that Iran’s Pickaxe Mountain nuclear site was not discussed, that Trump did not press Israel on Gaza reconstruction, and that he did not press for an IDF withdrawal from Syria or Lebanon. The first denial is the awkward one. A Times of Israel headline timestamped 17:45 on 28 July has Trump saying publicly, ahead of the meeting, that he does not need Netanyahu for intelligence on Pickaxe Mountain; this desk has not obtained the article text or the quote in context.

The same anonymous channel produced Wednesday’s second story. Briefing reporters, a senior Israeli official said Netanyahu raised weaning Israel off American aid within ten years in separate conversations with Vice President JD Vance and envoy Steve Witkoff, and quoted him: “I want to move from aid to partnership.” The current memorandum of understanding provides $3.8 billion annually and expires in 2028, months before the end of Trump’s term. IBTimes UK ran the same briefing at 22:30 BST with added colour about a new MoU and joint development funds; that is aggregation, not independent reporting. Reuters had Netanyahu telling The Economist in January 2026 that he wanted to “taper off the military within the next 10 years,” down to zero. An AFP survey published 16 May put US aid at under 8 percent of a 2026 Israeli defence budget swollen to roughly NIS 143 billion, about $49 billion.

Assessment: The absence of an American readout is the story, not a gap in it. With an Israeli election three months out and a Haaretz columnist already reading the trip as electoral desperation, the Prime Minister’s office had both the motive and the monopoly to write the record, and it did so through anonymous briefings that no second party can contradict. Weight the positive claims lightly and the negative ones less: “Pickaxe Mountain was not discussed” and “Trump did not press us” are unfalsifiable by design. The aid pledge is a year-old position re-released as news, and the 8 percent figure is a May measurement attached to a July announcement.

Announcement Before Attribution

Sixteen Minutes Separated ‘Reportedly' From ‘Confirmed' the Night Washington Struck Iran

Times of Israel’s liveblog logged American airstrikes on Iran at 02:16 and the US confirmation at 02:32. By 05:24 the count was CENTCOM’s own: dozens of IRGC targets, verified by nobody else.

At roughly 01:47 Israel time on Wednesday, CENTCOM said on the record that “Islamic Revolutionary Guard Corps forces launched multiple ballistic missiles from Iran in an attempted surprise attack on US forces based in the Middle East.” Times of Israel logged it as the first reported Iranian attack on an American target since Trump said over the weekend he would halt strikes after two weeks of fighting. CNN’s live page then headlined Trump saying it was “our turn”; the verbatim quote in context is not available to this desk. The liveblog sequence overnight ran 02:16, “US reportedly launching airstrikes in Iran”; 02:32, “US confirms striking Iran in ‘powerful response'”; 05:24, “US says dozens of IRGC targets hit amid ‘heavy wave of strikes'.” CENTCOM released strike video. “Dozens” is CENTCOM’s characterisation, not an independent count.

Early Thursday, a Jordanian Armed Forces spokesperson said air defences “engaged five missiles launched from Iran targeting the kingdom’s territory early this morning, Thursday,” all detected, intercepted and shot down, with no casualties. Times of Israel’s addition that the launches “appear to be a reaction” to the overnight American strikes is the outlet’s inference, not Amman’s. CNN’s live page carries a near-identical five-missile interception claim dated early Wednesday, with a different quoted line about protecting the kingdom’s airspace and sovereignty. Either Jordan intercepted five missiles on two consecutive days or one dateline is wrong; the two should not be merged. The precedent case remains unsettled too: for the 17 July attack in Jordan, CENTCOM said two service members were killed and one was missing, while NPR reported three killed.

The same CNN page illustrates how old numbers re-enter live circulation. It carries an Iranian state media figure of 168 children and 14 adults killed, sitting beside a retrospective headlined “Five months later” about a US strike on an Iranian school. The figure belongs to that strike, not this week, and is Iranian state media’s own. Dated context matters here: NPR reported on 18 July that Iran’s supreme leader, named in that copy as Mojtaba Khamenei, warned via state television of “unforgettable lessons” if American attacks continued and called Trump’s signature on the memorandum of understanding “worthless and invalid.” Britannica dates that MoU, intended to reopen the Strait of Hormuz, to June 2026. Al Jazeera’s 28 July live page headline: “Tehran vows Hormuz control amid Trump-Netanyahu talks.” A one-line Times of Israel entry at 02:16 records that Azerbaijan has banned two Iranian news outlets, unnamed.

Assessment: For several hours the public record of an American air campaign consisted of two liveblog timestamps and a video released by the party doing the striking. That is not a failure of the outlets; it is the shape of the cycle. The useful discipline is to hold the 02:16 and 02:32 entries apart rather than collapsing them, and to treat Jordan’s interception tally and CENTCOM’s target count as what they are: two militaries certifying their own performance. Note also that all of this happened while Netanyahu was still in Washington, and while his own officials were briefing that he had pressed no strategy at all.

Digital Front Monitor

Cyber operations, information warfare and the infrastructure of control across the region.
Most inspected systems in breach
Share of US water systems EPA inspected since 2023 found in violation of the 2018 risk-assessment rule
In violation70%Not in violation30%
EPA enforcement alert, March 2024 — a two-year-old figure being cited this week
Attribution Gap

Minnesota Confirms 30 Water Systems Hit; No US Agency Will Name Who Did It

The state activated a whole-of-government response after a coordinated attack on operational technology at community water utilities on 26–27 July. Headlines have already assigned it to Iran. Minnesota, the FBI and CISA have not.

Minnesota IT Services said on Tuesday 28 July that more than 30 community water and wastewater systems were impacted in what it called a coordinated cyberattack over the previous two nights, targeting operational technology at local utilities. “At this point, we can confirm that more than 30 water systems throughout the state were impacted,” MNIT told The Hacker News. The clearest single case is Braham, population 1,700, which posted on Monday morning that its water plant was “offline for an unknown reason” and asked residents to conserve because the tower held only a “limited quantity”; a later notice attributed the outage to “a malicious cyber-attack of computerized operating systems by unknown actors.” Plymouth and South St. Paul were among those affected, per the Star Tribune. Maple Plain declared a local state of emergency. MNIT said it knew of no requests for residents to change drinking-water use, and the Minnesota Department of Health confirmed water quality was unaffected at every impacted system. No boil-water advisories were issued.

The gap is in attribution. The Hacker News reported on 29 July that officials “have not publicly identified the attacker, affected products, exploited vulnerability, or whether data was stolen.” BleepingComputer noted the threat actor “remains unknown” while quoting agencies on the general pattern of state-sponsored pre-positioning. StateScoop called it “a cyberattack of undetermined origin.” Against that, Tech Times reported that researchers at Tenable believe the attack bears the hallmarks of CyberAv3ngers — an operation formally attributed to the IRGC — and that they suspect the use of CVE-2021-22681, an unpatchable Rockwell PLC flaw, four days after CISA updated advisory AA26-097A on roughly 22 July to widen its warning on internet-facing PLCs from Rockwell Automation, Schneider Electric, Siemens and “potentially other manufacturers.” Cybernews ran the headline “Iran hackers hit 30 Minnesota water systems.”

John Israel, MNIT’s assistant commissioner and Minnesota’s chief information security officer, framed the response rather than the culprit: “Cyberattacks against critical infrastructure require a coordinated, whole-of-government response.” The state said it worked containment, investigation, recovery and threat-intelligence sharing with CISA, the EPA, the FBI and the affected utilities. On the widened federal advisory that preceded the attacks, Joshua Corman of the Institute for Security and Technology told reporters the warning “should give everyone nightmare fuel.” The structural number sits further back: an EPA enforcement alert from March 2024 found that 70 percent of water systems inspected since 2023 were in violation of the risk-assessment and emergency-response-plan requirements of the 2018 America’s Water Infrastructure Act. The Star Tribune reports the EPA’s own view that attacks on municipal water are rising as operations grow more dependent on digital connectivity.

Old Claims, New Wave

The California Water Breach Being Cited This Week Happened in June, and Touched Billing, Not Controls

A June claim by a Tehran-linked group has been folded into this week’s coverage with its most important forensic finding removed. A separate 23 July claim about Maryland has no confirmation from anyone in Maryland.

StateScoop, covering the Minnesota attacks, reached back to a claim from 11–15 June 2026 in which a group it calls Hanzala said it had breached water utility systems in Bakersfield, Chico, Salinas and Stockton, and said it had restrained itself from disrupting supply. Iran International, sourcing Iranian state media on 12 June, reported the same claim and noted that the screenshots released “do not independently verify the group’s claim that it breached California water infrastructure or had the ability to disrupt water services.” The part that drops out in retelling is the forensics. Independent analysis by Dataminr, reported by SJV Water, found the breach limited to a GPS correction server and a customer billing database, with no evidence of compromise to operational technology or industrial control systems. California Water Service ran a preliminary scan and reported no signs of compromise in its IT or water production and delivery systems. No service disruption was observed.

The underlying incident was real but narrower than the claim. Dataminr saw the group publish five gigabytes of data on 11 June; leaked files exposed network infrastructure across seven operational areas — Bakersfield, Chico, Salinas, Stockton, Visalia, San Mateo and a regional engineering segment — and comprised names, addresses, phone numbers, account numbers and payment history from a billing database, plus access to RTKBase, a GPS tool used by field crews whose stolen credentials were the route into billing. Separately, Tech Times reports that on 23 July — three days before the Minnesota nights — Handala claimed an attack on Maryland’s operational technology infrastructure and declared US water, electricity and transportation networks front-line targets. No Maryland authority has confirmed anything. One further complication: StateScoop and Iran International write Hanzala, Hackread and Rescana write Handala, and no outlet in this sweep has confirmed they are the same group.

Assessment: This is how a claim becomes a capability in public memory. The June episode supports one sentence — a Tehran-linked group stole billing records and a surveying tool from a California utility — and cannot support the sentence it is now being used for, which is that hacktivists can reach American water controls. The Maryland pre-announcement cuts both ways: a group that names a sector three days before a mass event either has visibility or is claiming credit for the weather, and there is no way to tell from open sources. Until someone reconciles the two transliterations, treat any tally that adds Hanzala’s claims to Handala’s as arithmetic performed on a guess.

Watch Tomorrow — The Files' Forward Radar
  1. Iran File: Whether CENTCOM names any location for Thursday’s “heavy wave,” or whether Bandar Abbas and Kish remain sourced solely to Iranian state media via CNN.
  2. Sudan Crisis Monitor: Whether OCHA or IOM publishes the location breakdown behind the UN’s 20,000 newly displaced in Darfur, and whether Chad’s foreign ministry answers the Panel of Experts draft on the N’Djamena–Nyala corridor.
  3. The Brotherhood Brief: Whether any UK department comments on the designation of a London-based Brotherhood secretary general, one week after Treasury published SB0572.
  4. Western Media Watch: Whether any outlet independently verifies CENTCOM’s “over 30 IRGC-directed aerial drone attacks in the last 72 hours,” or whether the figure keeps travelling unattributed through headlines.
  5. Israel Press Review: Whether the White House issues any readout of the 28 July Oval Office meeting, or whether one anonymous senior Israeli official remains the only record of what was discussed.
  6. Digital Front Monitor: Whether MNIT, the FBI or CISA names an actor for the Minnesota water attacks, and whether Tenable publishes primary research on the CVE-2021-22681 claim.
The Files in your inbox

Get every morning's edition — free

Seven files, one region, zero illusions. The full daily edition, delivered at dawn Gulf time. No noise. Unsubscribe anytime.

We use MailerLite to send the edition. Confirm via the email you'll receive.  ·  Browse past editions