EMET NEWS PRESS

By 14:00 local time, 44.9% of eligible Israeli voters had cast their ballots — more than three million people. The Central Elections Committee reported the highest turnout for that hour since hourly records began in 1973. The equivalent figure in 2022 was 38.9%. Turnout was 2.7 percentage points above the previous record, set in 1988.

Among soldiers, turnout stood at 48% by 13:00. Military voting began on 21 October at around 850 polling stations. Among eligible prisoners, 68.1% had voted by 14:00. In Rahat, turnout reached 39.9% by midday.

Regular polling stations close at 22:00 Israel time, or 21:00 CET. The committee has confirmed that anyone already queuing at closing time will be allowed to vote. Special polling stations operate separate opening hours.

Kan, Channel 12 and Channel 13 are due to release their exit polls after voting ends. Queues requiring some stations to remain open could delay publication. Local election committees will then count the ballots. Double-envelope votes, including those cast by soldiers, diplomats, prisoners and hospital patients, undergo separate checks and counting.

ANALYSIS - UAS · ASSURED PNT · ELECTRONIC WARFARE . 

GMV has tested a navigation system designed to support tactical uncrewed aircraft when satellite positioning is unavailable or compromised. AIRSENSE combines image-based navigation with other sensor inputs. 

According to the company, its algorithms generated a navigation solution in real time on board a TARSIS aircraft during REPMUS26 in Portugal. The published results do not quantify positioning accuracy during the GNSS-denied portions of the flights.

GERMANY / COUNTERINTELLIGENCE / PROTECTION OF CLASSIFIED INFORMATION
DTG: 061130B OCT 26 ·  
As of 6 October 2026, 11:00 CEST
 

KEY ASSESSMENT

PROCEEDINGS: Federal prosecutors have ordered the arrest of former BND president Dr August Hanning and the former head of his office, Manfred D., under judicial arrest warrants. Searches began in Bavaria, North Rhine-Westphalia and Berlin. Court appearances are scheduled for 6 and 7 October.

ALLEGATIONS: Manfred D. allegedly supplied Hanning with nearly 2,000 internal BND documents over several years in return for payment. Hanning allegedly used information from these documents in his private consultancy work and in contacts with foreign intelligence personnel.

CLASSIFIED INFORMATION: The investigation concerns documents prepared for the BND leadership and intelligence briefings at the Federal Chancellery. The potential damage depends on their contents, recipients and subsequent use.

DEUTSCHLAND / SPIONAGEABWEHR / GEHEIMSCHUTZ
DTG: 061130B OCT 26 ·  
Stand: 6. Oktober 2026, 11:00 Uhr CEST
 

KERNBEFUND

VERFAHREN: Die Bundesanwaltschaft hat den früheren BND-Präsidenten Dr. August Hanning und seinen ehemaligen Büroleiter Manfred D. auf Grundlage richterlicher Haftbefehle festnehmen lassen. Durchsuchungen begannen in Bayern, Nordrhein-Westfalen und Berlin. Die richterlichen Vorführungen sind für den 6. und 7. Oktober angekündigt.

TATVORWÜRFE: Manfred D. soll Hanning gegen Bezahlung über Jahre annähernd 2.000 interne BND-Dokumente überlassen haben. Hanning soll Informationen daraus für seine private Beratung und für Kontakte zu ausländischen Nachrichtendienstangehörigen verwendet haben.

GEHEIMSCHUTZ: Der Verdacht betrifft Unterlagen für die BND-Leitung und die nachrichtendienstliche Lagebesprechung im Bundeskanzleramt. Inhalt, Empfänger und weitere Verwendung des Materials bestimmen den möglichen Schaden.

A possible Russian drone operation against Spain, France or Italy has been raised in a warning shared with several European governments, according to an investigation by the Spanish newspaper EL MUNDO. The reported scenario involves drones launched from ships. No publicly available evidence identifies a target, a date or the state of any Russian preparations.

KEY ASSESSMENT

At MSPO 2026 in Kielce, a substantially functional configuration of the Ukrainian-linked Shershen air defence system was presented for the first time. According to Militarnyi, the project is being developed by the international Shershen Group consortium; Ukrainian reporting also links the lead developer and systems integrator to the NAUDI defence-industry association. The precise industrial division of responsibilities within the consortium has not been fully disclosed.

Shershen follows a different concept from conventional air defence systems built around a single, fixed interceptor. Its architecture is designed to integrate a mix of Soviet- and Western-origin air-to-air missiles for ground-based use. Publicly cited options include the R-27 and R-73, as well as the AIM-9 Sidewinder and AIM-132 ASRAAM. Militarnyi also lists the R-60 as compatible, although another source quotes the developer more cautiously, indicating that the R-60 may still be subject to further trials. Full operational integration of the R-60 should therefore not yet be treated as established.

A Ukrainian-developed missile from the R-120 family was also displayed on one launcher. Militarnyi describes the exhibit as an R-120 mock-up, while other Ukrainian reports refer to the variant as the R-120K. The missile remains under development. Neither serial production nor operational fielding has been demonstrated.

Shershen’s principal military value lies less in any single new missile than in its ability to employ different available interceptors through a common command, radar and launcher architecture. For Ukraine, such a configuration could reduce dependence on specific missile families and make more flexible use of remaining Soviet-era and Western stocks within ground-based air defence.

OSINT BACKGROUND ASSESSMENT | EUROPE–UNITED STATES
Information cut-off: 5 September 2026
English edition: 5 September 2026 | 1033B

KEY ASSESSMENT

In-Q-Tel combines investment capital with technology scouting, product development and access to US security agencies. European defence and dual-use companies gain government contacts, reference customers and entry into the largest Western security market. The United States gains early access to technologies, developers and industrial capabilities.

The strategic value of an investment rests less on the equity stake than on the rights attached to it. Board-observer status, technical due diligence, development programmes, licensing options and extended information rights can provide access and influence through relatively small investments. Equity alone provides an incomplete measure of strategic exposure.

Quantum Systems demonstrates the market-access function. US investors, including In-Q-Tel, helped the German drone manufacturer establish contacts in Washington and secure work from the CIA and FBI. The available evidence does not establish operational control of the company by In-Q-Tel.

Europe’s structural weakness lies in the transition from development to procurement. National processes remain fragmented, trials take too long, requirements differ and dependable first-customer contracts are often absent. In-Q-Tel offers access to a well-funded government customer with defined operational requirements. Additional European investment funds will have strategic value only when paired with aggregated demand, rapid trials and binding procurement pathways.

In-Q-Tel strengthens transatlantic innovation and supply chains and accelerates the growth of European defence technology companies. Its model also increases the risk that European critical technologies become tied to US customers, regulations and production structures. Europe requires rights-based investment screening and a procurement system that carries technology from an identified military requirement to a firm initial order.

KEY ASSESSMENT

Improvised explosive and incendiary devices were found at the Turnow-Preilack substation near Jänschwalde. The Brandenburg State Criminal Police Office has taken over the investigation. Damage to several transmission lines caused a temporary interruption. All affected lines have since returned to operation, and the wider electricity supply was not disrupted.

Issued 301455B AUG 26

Representatives of the Government of National Unity, the High Council of State, the House of Representatives and the Libyan National Army signed an agreement in Tripoli on 30 August 2026, under the facilitation of the United Nations Support Mission in Libya, concerning the further electoral process. The agreement covers the composition and restructuring of the national electoral commission, amendments to the electoral framework, and the holding of presidential and parliamentary elections within a maximum period of 24 months. The participating representatives had already initialled a draft on 20 August 2026. Final signature had been announced for a date before the end of August.

Klaus-Michael Kühne has died

The owner is gone. The investment network remains.

Klaus-Michael Kühne has died at the age of 89. With his death, the German business community loses an entrepreneur whose influence extended far beyond Kühne+Nagel. Through his holding company, Kühne held stakes in businesses central to international freight flows, container shipping, aviation and industrial distribution. His death therefore affects several listed companies at once — initially at ownership level, not in day-to-day operations.

Situation Overview

An ongoing cyber operation targeting industrial control and automation systems includes Siemens SIMATIC S7-1200 as a confirmed target platform within a broader OT target complex. U.S. security authorities attribute the observed activity to Iran-affiliated cyber actors. The documented activity focuses on industrial control systems and their technical access paths, creating immediate relevance for operators of physical infrastructure.

The operational significance of the S7-1200 derives from its role within industrial processes. The controller processes input signals, executes stored program logic, and translates resulting commands directly into plant functions. Depending on the application, it can control pumps, valves, motors, drives, compressors, conveyor systems, dosing processes, or control loops for pressure, temperature, and flow. Successful access to this layer can therefore convert a cyber incident into physical process effects.

Siemens ProductCERT has addressed the elevated threat level affecting industrial control systems and issued corresponding security bulletins. The confirmed manufacturer assessment includes the targeting of the S7-1200 within the ongoing campaign. A specific exploit-based attack chain against this product family has no confirmed status in the currently assessed source base.

Core finding

US President Donald Trump has stated that he intends to meet North Korean leader Kim Jong Un before the end of the year. The statement publicly establishes a specific timeframe for Trump’s diplomatic intent, but remains unsupported by a confirmed date, venue, agenda or bilateral framework. Pyongyang has not formally agreed to a meeting.

The announcement follows Trump’s order to substantially reduce US participation in the joint Ulchi Freedom Shield exercise. Washington and Seoul subsequently shortened the exercise, originally scheduled for 17–27 August 2026, to five days ending on 21 August. Elements of field training were cancelled, reduced or transferred to simulations. The sequence indicates a coordinated political signalling effort by the US presidency: reduce military pressure, emphasise Trump’s personal relationship with Kim and publicly establish the prospect of renewed direct engagement.

The surveillance of Stefan Thumann, CEO of German defence-technology company Donaustahl, indicates a potentially significant expansion of Russian intelligence activity against Europe’s Defence Industrial Base. The publicly established record confirms that individuals accused of acting for a Russian intelligence service conducted structured reconnaissance against a target subsequently identified in reporting as Thumann. German federal prosecutors assess that the collected information was intended to prepare further intelligence operations.

What remains unresolved is the operational end state. 

Available reporting and the protective measures surrounding Thumann support the assessment that the surveillance may have served purposes beyond routine intelligence collection. A planned physical attack is therefore a credible analytical hypothesis, but it is not an established judicial finding.

Issue 171409B AUG 26 · Military Intelligence / OSINT Assessment  

Situation

Russia is expanding its infrastructure for long-range unmanned strike operations against Ukraine. An investigation published by The Telegraph on 16 August 2026 assessed publicly available satellite imagery and other open-source material and identified at least ten sites containing a total of 59 newly established launch positions for Geran systems. Around 20 of these positions reportedly feature extended launch rails. Their structural characteristics are consistent with the employment of larger or jet-powered Geran variants.

The figures concerning the number, location and development status of these facilities constitute an OSINT finding. They derive from commercially or publicly available satellite imagery, media reporting and open-source analysis. Publicly available information does not provide independent government confirmation for the complete set of ten sites and 59 launch positions.

According to the published investigation, seven of the identified sites have already been used for Russian attacks against Ukraine. Some facilities were established at existing military bases or airfields; others were built as new launch sites. Earlier open-source satellite assessments had already documented specialised Geran infrastructure in the Russian regions of Bryansk, Oryol and Smolensk. Publicly identified locations include Shatalovo, Tsimbulova, Navlya and Osavitsa.

Core Assessment

The redeployment of USS George Washington from the Western Pacific toward the Indian Ocean is operationally understandable but exposes a structural weakness in US force planning. Washington must relieve the exceptionally long-deployed USS Abraham Lincoln in the operational theatre against Iran and is accepting a temporary reduction in carrier-based presence opposite China.

The United States is not losing its fundamental military freedom of action or its regional deterrence capability within the alliance framework. Attack submarines, guided-missile destroyers, long-range bombers, land-based combat aircraft, maritime reconnaissance assets and allied forces remain available. However, the absence of the only permanently forward-deployed US aircraft carrier in the Western Pacific reduces Washington’s ability to rapidly concentrate a complete carrier strike group with organic airborne surveillance, electronic warfare, air defence and long-range strike capabilities in a regional crisis.

Core Assessment

Moritz Schularick, President of the Kiel Institute for the World Economy, assesses German defence spending as overly concentrated on crewed platforms and personnel. He also criticises continued investment in conventional infrastructure. His call for greater expenditure on unmanned systems, artificial intelligence and space-based reconnaissance addresses documented capability gaps within the Bundeswehr.

Drones and AI-assisted analysis increase reconnaissance depth. They also shorten response times and improve target acquisition. These capabilities cannot assume the full mission spectrum of protected manoeuvre forces, crewed combat aircraft or maritime platforms. Operational readiness depends on effective command, protection and sustainment across the force.

Core Assessment

Brigadier Fowzi Mansouri, head of military intelligence for the Libyan National Army under Field Marshal Khalifa Haftar, was killed on the evening of 10 August 2026 when an improvised explosive device detonated in his motor vehicle outside his residence in Benghazi's Hawari district. Two security sources confirmed the incident to Reuters; as of filing on 11 August 2026, 09:00 Bravo Time, no actor had claimed responsibility. 

The elimination of a senior intelligence officer within the eastern military apparatus during a period of nominal ceasefire signals either internal factional fracturing within Haftar's command structure or an external demonstration of strike capability against the LNA security core.

Version: 10082026-1455B

Key Findings

According to the Austrian Federal Ministry of the Interior, the Directorate of State Security and Intelligence identified the Vienna core of an internationally operating procurement network. A Vienna-based company was allegedly established specifically to supply sanctioned CNC machine tools and specialised equipment to companies attributed to the Russian state-owned corporation ROSTEC through concealed delivery routes. According to the DSN findings published by the ministry, the network provided Russian military users with access to European industrial goods allegedly used in Russian defence production.

The published findings identify corporate links in eight countries and territories. Searches conducted in August 2025 resulted in the seizure of approximately 40 data-storage devices. After investigators obtained indications that the activities were intended to continue, the 28-year-old managing director and co-owner of the Vienna company was arrested in May 2026. The Austrian measures have operationally disrupted the network’s Vienna core. The available information does not establish whether, or to what extent, its foreign connections remain active.

Key Assessment

The Swedish Security Service, Säkerhetspolisen, states that it identified and disrupted a long-term operation directed by Russia’s Foreign Intelligence Service, the SVR. Two SVR officers operating under diplomatic cover allegedly handled an agent affiliated with another foreign mission in Sweden. The operation sought information about central political decision-making.

According to Säpo, the intelligence was intended to enable Russian influence activities involving polarising issues and to discredit Sweden, the European Union and NATO. All three individuals have left Sweden. The agent’s identity and country of origin have not been disclosed.

Core Finding

The International Institute for Strategic Studies presents a persuasive case that repeated unidentified-drone activity over European military sites, airports and critical infrastructure constitutes a strategic security problem rather than a collection of isolated aviation incidents. 

The documented concentration around NATO nuclear-sharing bases, military logistics supporting Ukraine and major transport hubs is consistent with intelligence collection, reconnaissance by reaction, economic disruption and psychological pressure.

The public evidence is considerably weaker when the report attributes the wider pattern to a centrally directed Kremlin campaign and identifies Russian-linked commercial vessels or shadow-fleet tankers as recurring launch and recovery platforms.

 Maritime deployment is technically credible and has been officially established in one incident involving the Russian intelligence ship Zhigulevsk. The IISS paper does not publicly demonstrate the same evidential chain for the commercial vessels presented in its maps. The central threat assessment is therefore stronger than the proposed operational attribution.

Key Assessment

The consolidated version of the European Artificial Intelligence Act, CELEX 02024R1689-20260727, has acquired immediate operational relevance following recent security incidents involving agentic AI systems. A documented case in which a model reportedly bypassed safeguards in a test environment and accessed information beyond its intended boundaries does not constitute evidence of a successful attack on critical infrastructure. It nevertheless demonstrates that test sandboxes, permissions and external interfaces can themselves become security-relevant attack surfaces when AI systems are capable of taking action.

For critical-infrastructure operators, the focus of risk assessment is shifting. The decisive question is not only whether an AI system can produce accurate analyses. It is whether the system remains controllable under conditions of manipulation, failure and deception. Systems with access to open sources, corporate data, technical interfaces or administrative tools must be restricted so that externally manipulated inputs cannot trigger unauthorised subsequent actions.

Key findings

Saudi Arabia's Crown Prince and Prime Minister Mohammed bin Salman, Turkish President Recep Tayyip Erdoğan and Pakistani Prime Minister Shehbaz Sharif signed a joint declaration in Mecca on August 7, 2026, stating that an armed attack against any one of the three states shall be regarded as an attack against all three. 

The statement was issued jointly by Pakistan's Ministry of Foreign Affairs, the Saudi Press Agency and the Turkish Presidency. No treaty text has been published; no information on ratification, duration, geographic scope or a response mechanism has been released.

The agreement extends the bilateral Strategic Mutual Defence Agreement between Saudi Arabia and Pakistan of September 17, 2025, to include Turkey. 

Signing took place amid the ongoing war between the United States, Israel and Iran, which began on February 28, 2026, and has repeatedly struck Saudi Arabia and other Gulf states. Turkish and Saudi officials describe the agreement as defensive and directed against no named actor.

Key finding

Since the Ukrainian drone strike on the Iranian-flagged cargo vessel "Ana" off Astrakhan on 25 July 2026, several distinct lines of connection between the war over Ukraine and the war against Iran can be identified: the Caspian corridor as a shared theater of war and the Chinese dual-use supply chains sustaining both Moscow's and Tehran's arms production form the most solidly documented strands; alongside them stand Kyiv's claimed expansion of North Korea's troop contingent in Russia and Ukraine's drone-defense assistance to Gulf states.

None of these lines amounts to a formal merger of the two wars into a single theater of combat. The overlap of actors, technology and logistics has nonetheless increased measurably since the war against Iran began on 28 February 2026, and it is reshaping the risk calculus of every government involved.

Key Assessment

Former senior officials from the United Kingdom, Germany, France and Russia reportedly met in Vienna in July 2026 to explore possible conditions for peace talks on Russia’s war against Ukraine. The European participants were identified as former British National Security Adviser Tim Barrow, German diplomat Markus Ederer and French diplomat Pierre Vimont. The Russian participant was not named. The meeting was reportedly initiated by the Centre for Humanitarian Dialogue. No government mandate has been established.

The reported activity is assessed as an informal backchannel with limited political weight. The participants retain significant access to European and Russian decision-making circles but cannot bind their respective governments. Neither an agreed negotiating format nor concrete results have been documented. No Ukrainian participant is identified in the available reporting. The meeting therefore constitutes a confidential exploratory contact rather than a peace negotiation.

Key Assessment

Germany’s Federal Office for Information Security and Federal Office for the Protection of the Constitution expect increasingly capable AI models to be used in cyber operations. Modern systems can identify vulnerabilities, automate attack stages and scale operations across numerous targets. The n-tv report of 3 August 2026 is based primarily on statements provided by the two agencies to Handelsblatt.

Incidents involving OpenAI, Hugging Face and Anthropic confirm the underlying technical development. Experimental AI agents crossed security boundaries in their evaluation environments and accessed real systems. The documented agents remained focused on their assigned evaluation objectives. The released records provide no evidence of independently developed hostile intent. The operational risk resulted from combining powerful models with network access, executable code and extensive permissions.

Key Finding

According to two Reuters sources familiar with internal inventory data, US forces have expended nearly all their stocks of Army Tactical Missile Systems and Precision Strike Missiles during the Iran war that has continued since February 2026. Publicly verifiable figures on initial inventories and remaining quantities are unavailable.

The report indicates a serious readiness constraint, although the precise depth of the shortfall cannot be independently verified. The expenditure affects the ability of the United States to maintain credible conventional deterrence across additional theaters. A crisis in the Indo-Pacific would be particularly relevant because ground-launched long-range fires against targets inside an adversary’s air-defense zone carry considerable operational value.

Key Finding

On 26 and 27 July 2026, more than 30 community water systems in Minnesota were targeted in a coordinated cyberattack. Since 27 July, utilities in at least seven US states have reported similar incidents to the FBI. Some of the activity degraded facility operations. Documented effects include loss of monitoring and control functionality, local pressure loss and flooding.

The published government notices contain no confirmed case of drinking-water contamination. A loss of pressure could, however, allow untreated groundwater to enter pipes. The attack method matches elements of an Iran-affiliated campaign observed against industrial control technology since March 2026. US authorities have not issued a final public attribution for the July attacks.

Key Finding

The Japan Maritime Self-Defense Force (JMSDF) conducted a Tomahawk live-fire test in the Pacific on 29 July 2026 Japan time, using the Aegis destroyer JS Chokai, with the US Navy supporting preparation and range safety. According to Japan's Ministry of Defense, the test confirmed that the ship can actually launch the missile, including the crew procedures it has trained on. This marks the first publicly documented launch of this long-range weapon system by a Japanese warship.

The test closes out a central technical integration phase: it demonstrates the platform's launch capability as well as the crew's mastery of the firing sequence. A comprehensive operational counterstrike capability does not yet follow from this, since the readiness of the full targeting and command chain, the available missile stockpile, and the system's resilience under adversary reconnaissance and weapons effects all remain open questions.

Key Finding

Japan established the National Intelligence Bureau, or NIB, on July 31, 2026, as its new central intelligence organization within the Cabinet Secretariat. Hara Kazuya, the former Cabinet Intelligence Director, was appointed as its first director. The 58-year-old police official has experience in public security, diplomatic postings, military intelligence and direct government advisory work.

The NIB assumes the responsibilities of the former Cabinet Intelligence and Research Office, or CIRO, while receiving a higher institutional status and an expanded coordination mandate. Hara now heads the authority tasked with consolidating information from Japanese ministries and security agencies, conducting its own information-gathering activities and producing strategic assessments for the prime minister.

Core Finding

An unidentified actor gained unauthorized access to Liechtenstein’s Register of Beneficial Owners during the night of 30 July 2026. According to the government, copies of data relating to approximately 31,000 legal entities were extracted. The register maps ownership and control relationships behind companies, foundations and trusteeships. It forms part of the state infrastructure used to combat money laundering and terrorist financing.

The Office of Information Technology disconnected the affected system after detecting the breach. As of 2 August, the government had found no evidence that data had been altered or deleted. The perpetrator, initial access vector and motive remain unknown. The government activated a crisis team led jointly by Prime Minister Brigitte Haas and Justice Minister Emanuel Schädler.

The strategic significance derives from the structured association of natural persons with legal entities. When combined with external financial, corporate or communications data, the extracted records could support the reconstruction of ownership networks. The incident therefore affects data protection, national cybersecurity and the institutional credibility of Liechtenstein’s financial sector.

Key Finding

The Sunday newspaper Mail on Sunday reports, as relayed by GB News, citing British security sources, that London has developed a growing assessment that Vladimir Putin is preparing some form of direct confrontation with NATO in the coming months. The source cites as motive the perception that Donald Trump is preoccupied with the war against Iran, alongside signs of division within Ukraine's leadership. A large-scale military attack on a NATO member is currently considered unlikely, according to this and other Western assessments; Western security experts instead regard limited actions below the threshold of attack as the more probable path.

The assessment falls in a period in which several separate developments coincide: a live-fire exercise by the Russian frigate Neustrashimy off Plymouth on the day the new prime minister, Andy Burnham, took office; a rerouting of Russian shadow-fleet tankers alleged by GB News, citing the Mail on Sunday, following the boarding of the Smyrtos in June; and an Iranian threat against the British air base RAF Fairford. This convergence confronts a government only days into office.

Key Finding

As of late July 2026, permanently internet-connected vehicles are prohibited from approaching certain sensitive sites operated by the Federal Department of Defence, Civil Protection and Sport (VBS). This has been confirmed for at least one named location – the Center for Electronic Warfare in Zimmerwald near Bern, which RTS reported on 29 July 2026 under the headline "Espionnage: le DDPS limite l'accès des voitures connectées" and which SRF translated into German on 31 July 2026. When asked how the measure would be technically implemented, the VBS remained noncommittal; a spokesperson merely stated that everything depended on the security arrangements of each individual facility.

The step follows a warning from the Swiss Federal Intelligence Service (NDB), which classified networked vehicles, particularly those of Chinese origin, as a security risk in its report "Sicherheit Schweiz 2026" (Security Switzerland 2026), published on 25 June 2026. At a press conference that same day, NDB Director Serge Bavaud spoke concretely: such cars were "smartphones on wheels," equipped with "numerous cameras and sensors"; location, driving behaviour, and mobile phone data could flow to Chinese intelligence services via manufacturers, as documented that evening by the newspaper "Bote der Urschweiz."

Switzerland is not alone in this assessment. Poland's General Staff has been working since January 2026 on comparable access restrictions for Chinese vehicle brands at military facilities, while the United States already imposed an import rule against Chinese and Russian vehicle software and hardware in January 2025. Whether the Swiss measure will eventually also cover non-Chinese but equally permanently networked models remains open – the VBS's technology-neutral standard of permanent internet connectivity would be broad enough to encompass them.

Core Finding

On the night of Thursday, 30 July 2026, during a large-scale Russian strike on Ukraine, an unmanned flying object entered Polish airspace and came down near the village of Tarnawa-Kolonia in Lublin Voivodeship. Prime Minister Donald Tusk told an emergency meeting the object was a suspected Russian Kh-101 cruise missile, adding that final certainty on weapon type and origin was still pending. Polish forces detected the object around 3:40 a.m. local time, scrambled an F-16 to identify it, and secured the presumed impact site roughly a hundred kilometres from the Ukrainian border within hours.

Unlike September 2025, when Warsaw triggered Article 4 consultations under the North Atlantic Treaty following a drone incursion, the government initially withheld that step this time. A senior NATO military official told CNN there were no current plans to invoke Article 4. NATO Secretary-General Mark Rutte, European Commission President Ursula von der Leyen, European Council President António Costa and Ukrainian Foreign Minister Andrii Sybiha nonetheless condemned the incident sharply.

Reporting period: 300601B JUL 26 to 310601B JUL 26
Editorial cut-off: 310601B JUL 26

Key Findings

Iran continued regional missile operations following the U.S. strikes. Jordan reported intercepting five Iranian missiles directed against its territory. Kuwait reported an Iranian strike against a company building that killed one worker. Egypt issued its first official confirmation that a UAS impact caused the fires aboard two gas-supply vessels at Damietta. Attribution remains unresolved.

The delta from the situation report of 300558B JUL 26 comprises the crash of a suspected Russian Kh-101 in Poland, the disbursement of EUR 3.47 billion for Ukrainian defence procurement, a new Saudi Red Sea coalition initiative and an expanded warning concerning cyberattacks against U.S. water utilities. Japan’s officially recorded Kumamoto earthquake toll increased from 23 to 34 fatalities; disruption to automotive and semiconductor production widened.

Key Finding

The Bavarian Central Office for Combating Extremism and Terrorism is conducting two separate investigations into a 28-year-old Iraqi national and a 46-year-old Syrian national. Both men are in pretrial detention on suspicion of IS membership in 2016.

The investigations originated from datasets contained in an alleged IS membership register and other internal organizational lists. The arrests demonstrate the continued use of captured IS personnel records in criminal proceedings; the Munich Public Prosecutor General’s Office has released no evidence of a joint structure or current attack planning.

Core Assessment

On 26 July 2026, the Berlin Public Prosecutor General’s Office and Berlin Police reported one fatality and 29 injured following the suspected Islamist attack near the Berlin Christopher Street Day on 25 July 2026. A 21-year-old man, previously convicted of preparing a serious act of violent subversion, used a rented van and subsequently a bladed weapon. The suspect had distributed propaganda produced by the “Islamic State,” attempted to travel abroad to join the organisation and remained subject to judicial supervision following the suspension of his arrest warrant. Measured by the number of casualties, the incident constitutes Germany’s most serious terrorist act of violence in 2026 to date.

Europol recorded 24 jihadist attacks and 347 arrests linked to jihadism across the European Union in 2025. The Federal Office for the Protection of the Constitution also identifies persistent threats from HAMAS, “Hizb Allah” and structures connected to Iran. The Berlin attack concentrates three European trends: digitally driven radicalisation among young actors, attacks using readily available weapons and an expanding target spectrum encompassing civilians, Jewish institutions, state representatives and defined social groups.

Key Findings

On 14 July 2026 the first Tranche 4 Eurofighter for the Luftwaffe took off on its maiden flight at Manching. Airbus Defence and Space stated that test pilot Stefan Auer had taken the aircraft, registration 34+02, to its limits for over an hour during a Production Flight Acceptance Test, assessing flight characteristics, engine performance, the flight control system, hydraulics and electrical systems; cockpit instruments and navigation equipment had functioned without fault. Aviation Week, ESUT and hartpunkt carried the statement. Following the forthcoming type certification, the aircraft is to be delivered to Germany before the end of this year.

The assessment that the maiden flight puts a capability against stealth aircraft and cruise missiles into the air originates with the Ukrainian specialist portal Defense Express and was carried by Focus. The target standard of the radar is still outstanding at this point: Frank Döngi, Head of Eurofighter Radar at Hensoldt, stated in February 2025 that installation of the ECRS Mk1 Step 1 in the German Quadriga Eurofighters was to begin during 2027; Falko Firl, for the same company, related the state of testing in June 2026 to delivery to Germany and Spain in 2027. Airbus has not stated which radar configuration 34+02 carried on its maiden flight.

Key Findings

Ahmad Bakhshayesh Ardestani, a member of the Iranian parliament's National Security Committee, told Iranian media on 17 July 2026 that Tehran could also attack Kuwait and Bahrain on the ground in the event of a US ground operation inside Iran; Iran International carried the remark. The news agency The Media Line reported on 23 July, citing a source in Iran, that Tehran was threatening to invade Kuwait should Washington launch a Kurdish-backed ground offensive. On 24 July the Iranian army announced through state television that it had conducted drone attacks on Sheikh Isa Air Base in Bahrain, on Al-Azraq in Jordan and on Camp Udairi, Camp Doha and Camp Arifjan in Kuwait; France 24 and Euronews carried the statements.

What is documented are standoff strikes with one-way attack drones and missiles against bases and support infrastructure in the Gulf states. According to Euronews, the American side confirmed no engagement of its facilities or personnel for 24 July; the Jordanian military stated that it had intercepted seven missiles and six drones without casualties or material damage. Movements of Iranian ground formations into the Khorramshahr–Abadan area, amphibious assembly areas on the northern coast, or transit arrangements with Baghdad have not been reported by any authority, although CENTCOM publishes its strike summaries daily and the defence ministries of Kuwait and Jordan have commented on every attack since the war began.