Daily Security Brief — 11 August 2026

Intelligence Brief — 11 August 2026

Sources reviewed: BBC News, Al Jazeera, NOS, NL Times, Dark Reading, The Record. Coverage window: 36 hours prior to 08:00 CET. Pro-EU and NATO-aligned sources only.

Global Threat Landscape

• Major earthquake devastates Colombia, killing over 130 [corroborated] — A major earthquake struck Colombia on 10-11 August, killing at least 132 people in the country's worst seismic event in years, with search-and-rescue operations ongoing and mass casualties reported across affected regions. The scale of destruction, confirmed independently across international and Dutch outlets, points to significant strain on emergency services, transport corridors and communications infrastructure in the disaster zone. For organisations with personnel, assets or supply chains in Colombia, immediate priorities are accounting for staff, verifying the integrity of local facilities, and monitoring secondary risks including looting, civil unrest and disrupted logistics as aid flows in. Firms operating in the region should activate duty-of-care protocols and reassess movement plans until infrastructure stability is confirmed. Coordination with local authorities and NGOs will be essential in the coming days.
• Houthi missile barrage and Libyan refinery strike signal widening energy-sector risk — Yemen's Houthi movement launched ballistic missile attacks on al-Makha and Marib on 11 August, while separately a drone strike ignited a major fire at Libya's Zawiya refinery, one of the country's largest. Though each reported by a single wire source, both incidents fit an established pattern of asymmetric strikes against energy and logistics nodes across the Red Sea and North African littoral, compounding pressure from ongoing US-Iran talks over compensation and Strait of Hormuz access. Clients with maritime, aviation or extractive interests in Yemen, Libya or the wider Gulf should treat these as independent but reinforcing indicators of a tightening threat environment, with likely further disruption to shipping lanes, refinery output and regional air corridors. Continuous monitoring of maritime warning zones, NOTAMs and insurer war-risk updates is advised, alongside contingency planning for personnel movement through exposed corridors. Relevant capability: close protection for personnel transiting high-risk regions.

NATO & Allied Sphere

• Ukraine war continues mutual deep-strike campaign [corroborated] — Ukraine and Russia exchanged long-range strikes over the past 24 hours: a Ukrainian drone strike deep inside Russian territory killed at least 13, while Russian attacks on Zaporizhzhia and Kyiv killed at least six and left further wounded and buildings ablaze, according to multiple independent reports. The pattern confirms both sides retain the capability and intent to strike well beyond the front line, sustaining a high tempo of infrastructure and population-centre targeting heading into the autumn. For NATO's eastern flank and allied logistics hubs supporting Ukraine, this reinforces the standing assessment that Russian long-range strike and reconnaissance assets remain fully engaged, with no near-term de-escalation signal. Security planners supporting operations, transit or humanitarian logistics in the region should maintain heightened alert postures, verify shelter and evacuation plans, and continue tracking airspace advisories.
• Explosive drone debris in Germany yields DNA evidence, raising NATO-soil sabotage concerns — Dutch investigators report DNA traces recovered from the remains of an explosive drone found near a Ukrainian aircraft in Germany, a discovery that, if confirmed, would mark a significant escalation of sabotage activity onto NATO territory. Reported so far by a single source and requiring independent confirmation, the incident nonetheless fits a wider pattern of suspected Russian-linked sabotage, arson and drone incursions against European logistics tied to Ukraine support seen over recent years. Facilities, airfields and logistics providers handling Ukraine-related matériel or personnel in Germany and neighbouring states should treat this as a prompt to review perimeter security, counter-drone detection coverage and insider-threat vetting procedures. Relevant capability: counter-drone measures are advisable for sites handling sensitive logistics, aviation assets or personnel connected to the Ukraine support effort.
• Turkish parliament approves PKK amnesty, reshaping Ankara's internal security calculus — Turkey's parliament has voted to approve an amnesty for PKK members, a significant domestic security policy shift following years of conflict and the group's recent moves toward disarmament. As a NATO member bordering multiple conflict zones, changes to Turkey's internal security posture carry direct implications for regional stability, cross-border operations against residual PKK and Islamic State remnants, and the security environment for personnel and assets operating in south-eastern Turkey and northern Iraq and Syria border areas. While welcomed by some as a de-escalatory step, amnesty processes historically carry short-term risk of factional splintering among hardliners who reject the deal. Firms with personnel or interests in the affected region should monitor for localised unrest during the implementation period and reassess travel risk ratings accordingly.

Critical Infrastructure & Cyber

• Water-sector cyberattacks widen across multiple US states, Iran suspected [corroborated] — Security researchers report that attacks against municipal water systems across multiple US states have widened, with Iranian state-linked actors suspected of involvement, a threat significant enough that US Senate Democrats have introduced legislation to direct $300 million annually toward water-sector cybersecurity. The combination of an active, expanding intrusion campaign and a legislative response confirms water utilities remain one of the most under-resourced and heavily targeted critical infrastructure sub-sectors, particularly where legacy OT/ICS systems lack network segmentation and monitoring. Operators of water, wastewater and related utilities, and any organisation dependent on them, should prioritise asset inventory of internet-facing OT, multi-factor authentication on remote access, and incident response plans specific to ICS environments. Relevant capability: cybersecurity assessments tailored to operational technology environments are advisable for exposed utility operators and their contractors.
• European heat-grid breach and ransomware campaign expose sustained OT targeting — Polish authorities disclosed a second cyberattack against a district heat plant that went undetected for months, while the FBI and South Korean authorities separately warned that the Gunra ransomware gang is actively targeting critical infrastructure operators. Though single-sourced individually, together they illustrate a consistent global pattern: OT/ICS environments in the energy and utility sectors are being compromised for extended dwell times before detection, and ransomware crews are increasingly willing to target infrastructure rather than avoid it. European heating, power and water operators heading into the autumn and winter demand season should treat extended dwell-time compromise as a live risk, prioritising OT-specific threat hunting and network segmentation reviews rather than relying on perimeter defences alone.
• Metabase SQL zero-day and AI-agent identity gaps widen enterprise attack surface — A zero-day vulnerability in the popular Metabase business-intelligence platform is being actively exploited via SQL injection, with researchers warning of a wide potential blast radius given the tool's common use for exposing internal data to business users. Organisations running self-hosted Metabase instances, a common choice for finance, logistics and government-adjacent analytics teams, should treat this as an urgent patching priority and review which datasets and credentials are reachable through the platform. Separately, researchers flagged 'GhostJacking' as an emerging identity governance gap affecting autonomous AI agents, where compromised or over-privileged agent credentials can be hijacked to pivot across connected systems. As enterprises expand AI-agent deployments, security teams should extend existing identity and access governance frameworks to cover non-human, agentic identities with the same rigour applied to privileged accounts.