Daily Security Brief — 25 July 2026
A Houthi mass missile and drone attack sets the Aramco-affiliated Jizan refinery burning and strikes Yanbu — Saudi Arabia's only operational crude-export corridor with Hormuz closed — the first direct Houthi attack on Saudi oil infrastructure since 2022; Brent holds above $100, up roughly forty percent in July; CENTCOM concludes a thirteenth night of strikes and then goes quiet as Washington signals talks are getting more serious; Dutch police announce the arrest of a Rotterdam man for large-scale SMS phishing.
A Houthi mass missile and drone attack set the Aramco-affiliated Jizan refinery — 400,000 barrels per day — burning, with satellite imagery confirming the fires, and struck Yanbu, Saudi Arabia's only operational crude-export corridor while Hormuz remains closed. It is the first direct Houthi attack on Saudi oil infrastructure since 2022, framed as retaliation for Saudi strikes on Hodeidah and Kamaran. Brent holds above $100, up roughly forty percent in July. CENTCOM concluded a thirteenth night of strikes on Iran — and then went quiet, as President Trump signalled the talks are 'getting more serious.' In the Netherlands, Rotterdam police announced an arrest for industrial-scale SMS phishing.
Intelligence Brief — 25 July 2026
Sources cross-checked: The National, Times of Israel, CNN, OSINT satellite-imagery analysis, CENTCOM operational statements, Dutch police releases. Coverage window: 24 hours prior to 08:00 CET. Pro-EU and NATO-aligned sources only.
Global Threat Landscape
- Houthi mass strike on Saudi oil: Jizan refinery burning, Yanbu hit [corroborated] — Dozens of ballistic and cruise missiles plus drones targeted Aramco-affiliated facilities; satellite imagery confirmed the Jizan refinery ablaze, and Yanbu — the kingdom's only crude-export outlet with Hormuz closed — was struck. This is the first direct Houthi attack on Saudi oil infrastructure since 2022, and it crosses a threshold: energy-infrastructure targeting has moved from tanker harassment to refinery fires. Critical-infrastructure operators across the region should re-baseline their threat models around precision stand-off attack, not sabotage. Relevant capabilities: facility security assessment and critical-infrastructure preparedness.
- Oil above $100 — up forty percent in July [corroborated] — Brent held above $100 for the first sustained stretch since May, up roughly forty percent on the month, with two chokepoints threatened simultaneously and now a major refinery burning. The price shock propagates directly into EU energy markets and shipping-insurance rates; corporate security budgets in energy-exposed sectors will tighten and re-prioritise toward asset protection.
- CENTCOM concludes night thirteen — then silence [corroborated] — CENTCOM's official release covered a thirteenth consecutive night of strikes; no new strikes were announced overnight into 25 July, and President Trump signalled that talks are "getting more serious." The first tempo break in two weeks — meaningful, but unverified: the pattern this month has been pause, probe, resume.
Critical Infrastructure & Cyber
- NL: Rotterdam arrest for industrial-scale SMS phishing — Dutch police announced the arrest of a 22-year-old Rotterdam man (detained 20 July) for large-scale SMS phishing. The case illustrates how social-engineering tradecraft has industrialised at retail scale — smishing kits, bulk sender infrastructure, and cash-out chains run as a service. Organisations should assume staff personal devices are in scope for credential-harvesting campaigns and fold mobile-channel phishing into awareness and incident-response scope. Relevant capability: cybersecurity services.