Download a PDF version of this report

MAGNET S2 WEEKLY SNAPSHOT — 260726-1200Z
MAGNET S2
Weekly OSINT Intelligence Snapshot
DTG: 260726-1200Z  |  Reporting Period: 20–26 July 2026  |  United States Focus
www.magnethf.com
MAGCON STATUS
MAGCON
LEVEL 3
ELEVATED
MAGCON holds at Level 3 – ELEVATED; trend shifts toward a tactical pause on the Hormuz axis while a new spillover risk emerges at Bab el-Mandeb. For the first time in two weeks, the US military did not announce new strikes on Iran as of 25 July, and an Omani delegation visited Tehran (24–25 July) to discuss resuming Strait of Hormuz shipping. This is a lull in tempo, not a resolution: sirens sounded across Bahrain, Kuwait, and Jordan on 20 July as Iran struck a Kuwaiti power/water plant and targeted US bases, and the US struck a site near the Iraq–Iran border crossing and disabled another blockade-running vessel on 24 July; the Army confirmed the identity of a US service member killed in an Iranian attack in Jordan. Status: STRAIT OF HORMUZ REMAINS STABLE — PAUSED, NOT RESOLVED. Separately, Houthi forces attacked Saudi vessels this week enforcing a blockade of Bab el-Mandeb, compounding disruption alongside the still-effective Hormuz closure — a new secondary chokepoint risk. On Israel–Lebanon, the US-brokered trilateral framework moved from fragile-but-holding to active implementation: the Lebanese army deployed into the border village of Zawtar al-Gharbiya (21 July), and Lebanese President Aoun traveled to Washington seeking a permanent end to hostilities and a confirmed Israeli withdrawal. Domestically, the House Judiciary Oversight Subcommittee held a hearing (22 July) on conditions and protest disruption at the Delaney Hall ICE facility. Five new CISA KEV entries were added this cycle — notably two WordPress Core vulnerabilities relevant to magnethf.com’s own publishing platform. Two new MAGNET S2 flash reports on Flock Safety ALPR camera deployment were published since the last cycle. The 2026 FIFA World Cup closes out this cycle with a CIS post-event report confirming no successful attacks across 11 US host cities. PJM has no active grid alerts this cycle; Section 702/FISA and America 250 remain unchanged.
TREND VS LAST WEEK:  PAUSED, NOT RESOLVED (HORMUZ) / NEW SPILLOVER (BAB EL-MANDEB) / DE-ESCALATING (ISRAEL-LEBANON) / CLOSED OUT (FIFA WORLD CUP) / NEW OVERSIGHT ACTIVITY (DELANEY HALL) / FIVE NEW CRITICAL KEVS / NO CHANGE (PJM, SECTION 702, AMERICA 250)
PRIMARY RISK DRIVERS
  • PAUSED, NOT RESOLVED — Strait of Hormuz/Iran War: No new US strikes on Iran announced as of 25 July, first pause in two weeks; Omani delegation visited Tehran 24–25 July for shipping talks. But 20 July saw sirens across Bahrain/Kuwait/Jordan and a Kuwaiti power/water plant hit; US struck a site near the Iraq–Iran border and disabled a blockade-running vessel on 24 July; a US service member’s death in Jordan was confirmed. Iranian military official publicly contradicted Trump’s optimistic diplomatic framing.
  • NEW — Bab el-Mandeb / Red Sea Spillover: Houthi forces attacked Saudi vessels this week enforcing a blockade of Bab el-Mandeb, a critical oil corridor already strained by the effective Hormuz closure.
  • DE-ESCALATING — Israel–Lebanon Trilateral Framework Implementation: Lebanese army deployed into Zawtar al-Gharbiya (21 July), the first of three villages under the US-brokered framework. Lebanese President Aoun in Washington seeking to formalize a permanent end to hostilities and a confirmed Israeli withdrawal.
  • NEW — Delaney Hall Congressional Oversight Hearing: House Judiciary Oversight Subcommittee held a hearing (22 July) on facility conditions and protest-driven disruption to ICE enforcement operations at Delaney Hall, Newark, NJ.
  • NEW — Five Additional Critical CISA KEV Entries: DD-WRT (CVE-2021-27137), Langflow (CVE-2026-0770), WordPress Core x2 (CVE-2026-63030, CVE-2026-60137) added 21 July; Check Point SmartConsole (CVE-2026-16232) and Microsoft SharePoint deserialization (CVE-2026-50522) added 22 July.
  • CLOSED OUT — FIFA World Cup 2026 Post-Event Assessment: CIS released a post-event report (21 July) confirming the 39-day tournament faced 1B+ cyber threats and pro-jihadist calls for violence but no successful attacks across 11 US host cities and 6.25M spectators.
  • NEW — Flock Safety ALPR Flash Reports: Two new MAGNET S2 flash reports published since last cycle: Region 8 260720-2000Z (MARS Region 8 ALPR deployment) and Nationwide 260720-2000Z (nationwide ALPR expansion and digital footprint exposure risk to MAGNET personnel).
  • NO CHANGE — PJM Grid, Section 702/FISA, America 250: No active PJM grid alerts this cycle. Section 702 remains lapsed statutorily with FISC certifications continuing collection through ~March 2027. America 250 year-long observance continues through Dec 2026 with no new security incidents.
DELTA SUMMARY – CHANGES FROM LAST REPORT (260719-1200Z)
TOPIC DELTA FROM 260719-1200Z / STATUS
Strait of Hormuz / Iran War — Status PAUSED, NOT RESOLVED. No new US strikes on Iran as of 25 July (first pause in 2 weeks); Omani talks in Tehran 24–25 July. Sirens Bahrain/Kuwait/Jordan 20 July, Kuwaiti plant hit, US border-area strike + vessel interdiction 24 July, US KIA in Jordan confirmed.
Bab el-Mandeb / Red Sea NEW. Houthi attacks on Saudi vessels this week enforcing blockade; compounding Hormuz-linked disruption.
Israel–Lebanon Trilateral Framework DE-ESCALATING. Implementation begins; Lebanese army deployed into Zawtar al-Gharbiya (21 July); Pres. Aoun in DC seeking permanent end to hostilities.
Delaney Hall ICE Facility NEW. House Judiciary Oversight hearing held 22 July on facility conditions and protest disruption.
CISA KEV Catalog NEW. 5 additional entries (DD-WRT, Langflow, WordPress Core x2, Check Point SmartConsole, SharePoint deserialization), 21–22 July.
FIFA World Cup 2026 CLOSED OUT. CIS post-event report (21 July) confirms no successful attacks across 11 host cities; de-prioritized as active watch item.
Flock Safety ALPR (Flash Reports) NEW. Two flash reports published since last cycle (Region 8; Nationwide expansion / digital footprint risk).
PJM Grid Reliability NO CHANGE. No active alerts this cycle.
Section 702 / FISA NO CHANGE. Remains lapsed; FISC certifications continue authorizing existing collection.
America 250 NO CHANGE. Year-long observance continues; no new incidents identified.
Domestic Political Continuity NO CHANGE. No new discrete incident this cycle; baseline elevated political-violence trend persists.
NO CHANGE:
  • MAGCON level holds at 3 – ELEVATED
  • PJM Grid — no active Maximum Generation / Load Management / Hot Weather alerts this cycle
  • Section 702 / FISA — remains statutorily lapsed; FISC certifications continue authorizing existing collection through ~March 2027
  • America 250 — year-long semiquincentennial observance continues through December 2026; no new security incidents identified this cycle
  • Domestic Political Continuity — no new discrete incident this cycle; baseline elevated political-violence trend persists as a standing watch item
SECTOR THREAT LEVELS
SECTOR LEVEL NOTES
Terrorism / Extremism ELEVATED FIFA World Cup concluded without incident; Hormuz pause reduces near-term retaliatory risk but Delaney Hall protest friction continues.
Cyber / Infrastructure ELEVATED Five new CISA KEV entries this cycle including two WordPress Core vulnerabilities directly relevant to magnethf.com’s platform; SharePoint deserialization chain continues to grow.
Energy / Economic CRITICAL Carried forward — no fresh pricing data collected this cycle; prior cycle’s elevated fuel/shipping/insurance cost impacts presumed to persist pending confirmed easing.
Civil Unrest HEIGHTENED Delaney Hall House Judiciary Oversight hearing (22 July) underscores continued baseline ICE-enforcement-adjacent tension.
Transportation / Mass Gatherings ROUTINE FIFA World Cup Final concluded last cycle without incident; no new major mass-gathering event flagged this cycle.
Public Health / Environmental ELEVATED Carried forward at prior assessment; no fresh wildfire/air-quality reporting collected this cycle pending next OSINT sweep.
Border / Immigration HEIGHTENED House Judiciary Oversight hearing on Delaney Hall this cycle; anticipate continued legislative/media attention.
Domestic Political / Continuity HEIGHTENED No new discrete incident this cycle; baseline elevated political-violence trend persists nationally.
Grid / Utilities ROUTINE No active PJM alerts this cycle; national reserve-margin tightening remains a longer-term structural watch item.
GLOBAL CHOKEPOINT WATCH
CHOKEPOINT STATUS ASSESSMENT
Strait of Hormuz CRITICAL Held at CRITICAL. Tempo has slowed — no new US strikes announced as of 25 July, Omani-mediated talks resumed — but this reflects a pause, not resolution. War-risk insurance and shipping costs remain at crisis levels pending confirmed reopening.
Bab el-Mandeb / Red Sea HEIGHTENED Escalated from ELEVATED. Houthi forces attacked Saudi vessels this week enforcing a blockade, compounding disruption alongside the still-effective Hormuz closure.
Panama Canal ROUTINE Stable. Normal operations. No new reporting this cycle.
Strait of Malacca ELEVATED No new significant reporting this cycle; carried forward pending fresh OSINT sweep next cycle.
KEY INCIDENTS
STRAIT OF HORMUZ PAUSE AND BAB EL-MANDEB SPILLOVER (20–26 July)

The tempo of US-Iran strikes over the Strait of Hormuz slowed markedly this cycle after nearly three weeks of near-continuous escalation. Sirens sounded across Bahrain, Kuwait, and Jordan on 20 July as Iran launched missile and drone strikes against US military infrastructure, damaging a Kuwaiti power/water plant and prompting Jordanian air-defense intercepts. The US struck a site near the Iraq–Iran border crossing and disabled another vessel attempting to breach its naval blockade of Iranian ports on 24 July; the Army separately confirmed the identity of a US service member killed in an Iranian attack in Jordan.

As of 25 July, the US military had not announced new strikes on Iran for the first time in two weeks, and an Omani diplomatic delegation visited Tehran (24–25 July) to discuss resuming Strait of Hormuz shipping. Messaging remains contradictory: President Trump characterized Iran as “getting more serious” about a deal, while an Iranian military official publicly invited a US ground invasion the same weekend. Per standing MAGNET S2 convention, this is assessed as a pause in kinetic tempo, not a resolution of the underlying crisis.

Separately, Houthi forces attacked Saudi vessels this week as part of an effort to enforce a blockade of the Bab el-Mandeb Strait — a secondary chokepoint disruption compounding the still-effective closure of Hormuz and warranting elevation of that chokepoint’s status this cycle.

ISRAEL–LEBANON TRILATERAL FRAMEWORK: IMPLEMENTATION BEGINS

The US-brokered trilateral framework between Israel, Lebanon, and the United States moved from a fragile standstill into active implementation this cycle. The Lebanese army deployed into the border village of Zawtar al-Gharbiya on 21 July, the first of three villages designated for phased Israeli withdrawal and Lebanese government control under the framework. Lebanese President Joseph Aoun traveled to Washington, DC, stating his goal is to end the “state of hostility between Lebanon and Israel forever” and seeking US backing to secure a confirmed Israeli withdrawal from remaining occupied areas in the south.

This represents a de-escalatory shift from the prior cycle’s fragile-but-intermittently-violated posture, though full implementation across all designated areas remains pending. Assessment: monitor village-by-village progress and outcome of Aoun’s Washington talks before treating the framework as durable.

DELANEY HALL: HOUSE JUDICIARY OVERSIGHT HEARING (22 July)

The House Judiciary Subcommittee on Oversight held a hearing titled “False Narratives Surrounding Conditions at the Delaney Hall ICE Detention Center” on 22 July, examining the importance of ICE detention operations and how sustained protest activity at the Newark, NJ facility has disrupted enforcement efforts and, per the subcommittee’s framing, put public safety at risk. The hearing follows months of clashes between law enforcement and protesters outside the facility beginning in late May, including allegations of poor detainee living conditions that protesters say motivate their demonstrations.

No new incidents at the facility itself were reported this cycle; the hearing itself is the primary development. Assessment: watch for legislative or administrative follow-on action, and for any renewed protest activity tied to the hearing’s public attention.

FIFA WORLD CUP 2026: POST-EVENT THREAT ASSESSMENT

The Center for Internet Security (CIS) released a report on 21 July detailing its embedded threat-monitoring support throughout the 39-day, three-nation 2026 FIFA World Cup, which concluded 19 July. The report confirms the tournament faced more than one billion cyber threats, pro-jihadist calls for knife, vehicle, and arson attacks, and threats of violence against players, referees, and fans across 11 US host cities and roughly 6.25 million spectators — with no successful attacks recorded.

This closes out the tournament as an active MAGNET S2 watch item; recommend de-prioritizing absent new scheduled mass-gathering events tied to the tournament’s legacy.

CYBER / INFRASTRUCTURE KEV BULLETIN
KEV Bulletin — Patch Immediately
CVE / SYSTEM SEVERITY ACTION REQUIRED
CVE-2021-27137
DD-WRT
CRITICAL NEW KEV 21 July. Stack-based buffer overflow; legacy router firmware, frequent attack vector on internet-exposed devices. Patch or replace affected devices.
CVE-2026-0770
Langflow
CRITICAL NEW KEV 21 July. Inclusion of functionality from untrusted control sphere on AI workflow platform. Patch per BOD 26-04 guidance.
CVE-2026-63030
WordPress Core
CRITICAL NEW KEV 21 July. Interpretation conflict vulnerability. Directly relevant to magnethf.com’s own publishing platform — prioritize.
CVE-2026-60137
WordPress Core
CRITICAL NEW KEV 21 July. SQL injection vulnerability. Companion WordPress Core flaw — patch alongside CVE-2026-63030.
CVE-2026-16232
Check Point SmartConsole
HIGH NEW KEV 22 July. Improper authentication vulnerability. Frequent attack vector for malicious cyber actors.
CVE-2026-50522
Microsoft SharePoint
CRITICAL NEW KEV 22 July. Deserialization of untrusted data. Extends the ongoing on-premises SharePoint exploitation chain (CVE-2026-32201/-45659/-56164/-58644).
EMERGING INDICATORS
  • Watch: Hormuz ceasefire trajectory — monitor whether the 25 July pause and Omani-mediated talks produce a durable de-escalation, or whether the contradictory US/Iran messaging this cycle signals only a tactical lull before renewed strikes.
  • Watch: Bab el-Mandeb / Houthi-Saudi escalation — track further Houthi targeting of Saudi vessels and any broadening of the blockade effort; assess compounding effect on Gulf-linked shipping already strained by Hormuz.
  • Watch: Israel–Lebanon framework village-by-village implementation — monitor whether Israeli withdrawal and Lebanese army deployment proceeds to the remaining two designated villages, and outcomes of Pres. Aoun’s Washington talks.
  • Watch: Delaney Hall hearing follow-on action — track any legislative, policy, or protest-related developments stemming from the 22 July House Judiciary Oversight hearing.
  • Watch: WordPress Core KEV exploitation — given magnethf.com’s own WordPress platform, monitor for exploitation attempts against CVE-2026-63030 / CVE-2026-60137 and confirm internal patch status.
  • Watch: National grid reserve margins — carried forward; analysts continue to flag tightening national reserve margins (projected below 20% safety threshold by 2027) as a standing structural risk despite no active PJM alerts this cycle.
VERIFIED STATUS
  • CONFIRMED Sirens sounded across Bahrain, Kuwait, and Jordan on 20 July; a Kuwaiti power/water plant was hit by Iranian strikes. (RFE/RL via GlobalSecurity.org, Al Jazeera — 20 July 2026)
  • CONFIRMED The US military did not announce new strikes on Iran as of 25 July — the first such pause in two weeks. (CNN — 25 July 2026)
  • CONFIRMED An Omani diplomatic delegation visited Tehran 24–25 July for Strait of Hormuz shipping talks. (CNN, ABC News — 25 July 2026)
  • CONFIRMED The Lebanese army deployed into the border village of Zawtar al-Gharbiya on 21 July under the trilateral framework. (Al Jazeera — 21 July 2026)
  • CONFIRMED The House Judiciary Oversight Subcommittee held a hearing on Delaney Hall conditions and protest disruption on 22 July. (House Judiciary Committee, PBS News — 22 July 2026)
  • CONFIRMED Five new CISA KEV catalog entries were added 21–22 July 2026. (CISA — 21–22 July 2026)
  • NOT CONFIRMED Whether the 25 July Hormuz pause reflects durable ceasefire progress or a tactical lull — an Iranian military official publicly contradicted President Trump’s optimistic framing the same weekend. (CNN — 25 July 2026)
  • NOT CONFIRMED Current fuel, shipping, and marine-insurance pricing trend this cycle — no fresh quantified data point was collected; prior cycle’s crisis-level figures are carried forward as a presumption only.
OPERATOR GUIDANCE
  • MARITIME / SHIPPING — Continue avoiding Strait of Hormuz transit without current TRANSCOM/JMIC guidance. Monitor Bab el-Mandeb closely given new Houthi targeting of Saudi vessels this week; anticipate continued elevated freight and insurance costs across all Gulf-linked supply chains.
  • PATCH WORDPRESS CORE NOW — CVE-2026-63030 and CVE-2026-60137 directly affect magnethf.com’s own platform; prioritize immediate patching per BOD 26-04.
  • CYBER — OTHER KEV ITEMS — Patch DD-WRT (CVE-2021-27137), Langflow (CVE-2026-0770), Check Point SmartConsole (CVE-2026-16232), and confirm SharePoint deserialization chain (CVE-2026-50522 and prior related CVEs) remediation status.
  • NJ / NORTHEAST OPERATORS — Monitor Delaney Hall for possible protest activity in response to the 22 July House hearing; anticipate continued media and legislative attention to the facility.
  • DIPLOMATIC TRACKING — Track Israel–Lebanon village-by-village withdrawal implementation and Pres. Aoun’s Washington talks for signs of durable de-escalation versus stalled progress.
  • GENERAL — No change to standing guidance for Section 702, America 250, or PJM grid conditions at this time.
  • Report cyber incidents to cisa.gov or IC3.gov.
SOURCE LIST
  • [1]   [B2] CNN — US military does not announce new Iran strikes for first time in 2 weeks, 25 July 2026 — cnn.com
  • [2]   [B2] ABC News — Iran live updates: Trump met with advisers on Iran options, 25 July 2026 — abcnews.com
  • [3]   [B2] Britannica — 2026 Iran War live event log — britannica.com
  • [4]   [B2] RFE/RL via GlobalSecurity.org — Air raid sirens sound in Bahrain, Kuwait as Iran claims fresh strikes, 20 July 2026 — globalsecurity.org
  • [5]   [B2] Al Jazeera — Iran attacks Bahrain, Kuwait and Jordan after US hits Iranian nuclear site, 19 July 2026 — aljazeera.com
  • [6]   [B2] Al Jazeera — Israel attacks Lebanon topic page (Lebanese army deploys into Zawtar al-Gharbiya), 21 July 2026 — aljazeera.com
  • [7]   [A1] House Judiciary Committee — Hearing: False Narratives Surrounding Conditions at the Delaney Hall ICE Detention Center — judiciary.house.gov
  • [8]   [B2] PBS News — House panel examines Delaney Hall ICE detention center conditions and protests, 22 July 2026 — pbs.org
  • [9]   [A1] CISA — Adds Four Known Exploited Vulnerabilities to Catalog, 21 July 2026 — cisa.gov
  • [10] [B2] OpenText Cybersecurity Community — CISA Adds Two Known Exploited Vulnerabilities, 22 July 2026 — opentextcybersecurity.com
  • [11] [B2] EIN Presswire — Inside the Security Operation Behind the 2026 FIFA World Cup, 21 July 2026 — einpresswire.com
  • [12] [A1] MAGNET S2 Report 260720-2000Z — Flock Safety ALPR Camera Deployment, Region 8 — magnethf.com
  • [13] [A1] MAGNET S2 Report 260720-2000Z — Flock Safety Nationwide ALPR Expansion — magnethf.com
Submit reports through established MAGNET situational awareness channels.
To Learn More About MAGNET, Visit www.MAGNETHF.COM