Daily Security Brief: 22 July 2026

Intelligence Brief: 22 July 2026

Sources cross-checked: Reuters, AP, Al Jazeera, Just Security, CENTCOM operational statements, Netherlands Ministry of Defence releases, NATO communiqués, CISA advisories and Known Exploited Vulnerabilities catalog. Coverage window: 24 hours prior to 08:00 CET. Pro-EU and NATO-aligned sources only.

Global Threat Landscape

• Eleventh consecutive night of strikes; southern Iran targeted after US fatalities [corroborated]
  CENTCOM confirmed strikes on Iranian military command centres, maritime capabilities, missile and drone launch sites, and air-defence systems in southern Iran. They followed the ordnance-handling deaths that raised the US toll to seventeen. Eleven consecutive nights of strikes, explicitly framed by Washington as retaliation, make this the most sustained phase of the campaign to date. Organisations with regional exposure should keep crisis plans at current levels and expect no drop in tempo this week.
• Iranian fire reaches Bahrain, Kuwait, and Jordan; tanker hit off Oman [corroborated]
  Iran launched drone attacks against three US military bases in Kuwait and targeted sites in Bahrain and Jordan. Jordan's military reported downing all five drones and three missiles aimed at its territory. A tanker was struck off the Omani coast in the Strait approaches, continuing the pattern of contesting the southern workaround corridors. Spillover across several countries is now a standing feature of this war, not an anomaly. Warden networks, shelter-in-place drills and evacuation triggers across the GCC should be run as live systems and checked weekly. Relevant capability: hostile-environment safety planning and close protection deployment.
• War cost estimate reaches $37.5 billion; salvage diplomacy continues without traction [corroborated]
  Independent tallies put the conflict's direct cost at roughly $37.5 billion as of 21 July. Efforts to salvage the collapsed June framework continue through Pakistani, Chinese and now Southeast Asian channels, but none is gaining traction while strikes continue at this pace. Planners should keep no de-escalation as the base case through the end of July.

NATO & Allied Sphere

• Netherlands assigns amphibious task group to Allied Reaction Force [corroborated]
  The Netherlands assigned an amphibious task group to NATO's Allied Reaction Force, where it will stand by for a full year for immediate deployment in defence of the treaty area. Together with the joint amphibious-ship procurement with the UK, worth up to €2.5 billion, the assignment fixes the Dutch role as the Alliance's expeditionary-maritime specialist. It also keeps long-lead demand steady for embarked-force training, port security and vetted logistics support.
• 1 German-Netherlands Corps assumes tactical command for Estonia and Latvia [corroborated]
  The 1 German-Netherlands Corps (1GNC) is now the tactical NATO headquarters responsible for Estonia and Latvia, taking over from Multinational Corps North East. The command shift puts Dutch staff officers at the centre of Baltic defence planning. It comes as the shadow-fleet drone campaign has made Baltic installations the Alliance's most-probed real estate. Expect site and personnel security requirements around 1GNC-affiliated facilities to tighten accordingly.
• Dutch munitions co-production lead formalised [corroborated]
  The Netherlands is taking the European lead on co-production, scaling-up and maintenance of US-designed munitions (Stinger, AMRAAM and PAC-3). The role brings ITAR-adjacent security obligations, cleared-personnel requirements and hardened-facility standards to a growing Dutch industrial footprint. Firms entering this supply chain face vetting and physical-security requirements that most commercial operators have never carried. Relevant capability: facility security assessment and CBRN readiness training for sites handling energetic materials.

Critical Infrastructure & Cyber

• SharePoint federal deadline passes — posture shifts from patching to hunting [corroborated]
  The 19 July federal deadline for the KEV-listed SharePoint remote-code-execution flaw has passed with exploitation chains still active in the wild. CISA's guidance now emphasises Defender and AMSI detections to identify exploitation attempts. That is an implicit admission that a patched server is not a safe one if its machine keys were stolen before the patch went in. Organisations that patched after the first exploitation reports should run compromise assessments, rotate IIS machine keys and audit for persistence. Relevant capability: incident response and digital forensics.
• IP-camera espionage campaign remains active across NATO states [corroborated]
  AIVD and MIVD reporting confirms that Russian state-sponsored actors continue to exploit internet-accessible IP cameras systematically across European NATO members, including the Netherlands. They harvest the footage to track military movements and to build pattern-of-life pictures of facilities. Any internet-reachable camera on or near a sensitive site is a collection asset for someone. Organisations should inventory external camera exposure, segment video networks and treat every camera placement as a counter-surveillance decision. Relevant capability: technical surveillance counter-measures.
• Appliance-layer siege continues — three families under simultaneous exploitation
  SharePoint, AD FS and Citrix NetScaler have all been under active exploitation in the same fortnight. For European organisations, perimeter appliances and collaboration platforms remain the contested boundary. The same defensive lessons hold across all three. Patching closes the way in but does not evict an intruder. Logging has to survive a compromise. And a clean bill of health takes forensic verification, not an absence of alerts.