The latest published intelligence briefing for each active theater, most active first. Every section links to the live theater view on the dashboard.

A Russian strike on a military exhibition near Kyiv killed named senior personnel — including a GUR colonel, a state protection official, and a Polish defense company employee — and prompted the detention of the event's organizer; simultaneously, activity spiked across Zaporizhzhia, Kyiv, Dnipropetrovsk, Kharkiv, and Sevastopol relative to the 7-day baseline.

Kyiv (up 233% vs baseline): Two strikes were recorded, both partial-confidence. The higher-significance event was a Russian strike on a military exhibition near Kyiv attended by over 300 participants, including international partners. Named casualties are GUR Colonel Eduard Sirenko, State Protection Directorate official Valentina Savitskaya, and an employee of a Polish defense company. Ukraine's Prosecutor General has detained the event's chief organizer for failing to coordinate with military command. A separate ballistic missile attack on Kyiv city produced confirmed explosions; no casualty or damage details are available.

Zaporizhzhia (up 58% vs baseline): Three events recorded, all partial-confidence. Russia struck a Nova Poshta postal sorting center in Zaporizhzhia city (no confirmed casualties) and separately hit civilian infrastructure in the city, killing one person — both corroborated by official statements and visual evidence. Ukrainian forces struck a tourist base in Kirillivka, killing 12 and wounding 19 per the same partial-confidence reporting.

Dnipropetrovsk (up 150% vs baseline): A shopping center in Kryvyi Rih was set on fire following a reported Russian attack; this is the single verified event of the period. Casualty figures remain unconfirmed per the oblast military administration.

Kharkiv (up 67% vs baseline): A Russian strike drone hit a car in the Shevchenko district, wounding one person — confirmed by the city mayor, partial-confidence.

Sevastopol (up 900% vs baseline): A Ukrainian attack wounded three civilians; reported by the Russian-appointed governor, partial-confidence.

The strike on the Kyiv military exhibition is the most operationally significant event of the period. Hitting an event attended by international defense partners and senior Ukrainian officials — and killing a GUR colonel — signals either actionable intelligence about the event's location or a broader pattern of targeting defense-coordination gatherings. The subsequent detention of the organizer exposes a security coordination failure with potential institutional consequences. The Kryvyi Rih shopping center strike (verified, four sources) continues a documented pattern of Russian attacks on civilian economic infrastructure in Dnipropetrovsk. The elevated Zaporizhzhia tempo, including a strike on a logistics node (Nova Poshta), suggests continued pressure on civilian supply infrastructure.

Watch for official Ukrainian casualty and damage assessments from the Kryvyi Rih shopping center strike, which would indicate the full scale of the verified Dnipropetrovsk event. Monitor for additional reporting on the Kyiv exhibition strike — corroboration of the Polish defense company casualty or further named victims would indicate broader international exposure. Track any Russian claims or Ukrainian official statements regarding the Kirillivka strike in Zaporizhzhia, which remains single-sourced on the Ukrainian side; additional corroboration would indicate a shift in Ukrainian strike posture toward occupied civilian-use sites. Watch for further Ukrainian or Russian activity in Sevastopol; the 900% baseline spike is based on a single partial event and may normalize, but a follow-on event would indicate a sustained Ukrainian maritime-flank campaign.

A reported ceasefire collapse has triggered a multi-front exchange across Yemen, with unconfirmed strikes, drone shootdowns, and ballistic missile launches spanning Taiz, Marib, Al Jawf, Saada, and the Red Sea — all within 24 hours but carrying zero verified sourcing.

All eight events this period are single-sourced and unconfirmed; none meet the verified threshold.

Against a 7-day baseline of near-zero activity, Saada logged two unconfirmed events — a 1,900% spike — and five governorates with no prior baseline (Taiz, Marib, Al Jawf, Sanaa, Red Sea off Al Hudaydah) each recorded at least one event.

The most significant reported shift is the described end of a four-year ceasefire: government-affiliated airstrikes against Houthi missile sites and weapons depots in Marib and Al Jawf are characterized as among the first offensive operations since that ceasefire's collapse. Separately, Houthi sources claimed two Bayraktar Akıncı drones belonging to Saudi forces were shot down — one over Saada, one over Al Jawf — both provisional and originating from Houthi-affiliated statements only. Two unconfirmed ballistic missile launches from the al-Hoban area east of Taiz targeting Red Sea shipping lanes were reported by local sources with no maritime incident confirmed. UKMTO reported a suspicious near-miss on a tanker in the southern Red Sea; projectile type and origin remain unidentified and under investigation.

If the ceasefire collapse is confirmed, it would represent the most significant structural shift in the Yemen conflict in four years. The geographic breadth of reported activity — six distinct areas in 24 hours — suggests a potential return to multi-front tempo. The dual drone-shootdown claims and ballistic launches toward Red Sea shipping lanes, if verified, would indicate renewed threats to maritime traffic consistent with prior Houthi interdiction campaigns.

Watch for independent corroboration of the ceasefire collapse claim, which would indicate a durable change in the conflict's operating framework. Monitor UKMTO and maritime channels for follow-on shipping incidents in the southern Red Sea. Any additional Saudi air activity over Saada would indicate an escalating air campaign in the north. Verified casualty reporting from Marib and Al Jawf strike sites would help assess the scale of government offensive operations. Watch for Houthi official statements beyond spokesman claims to gauge whether drone-loss acknowledgments or retaliatory postures emerge.

Ukraine executed a wide-ranging strike campaign on 25–26 July targeting Russian energy infrastructure deep inside Russian territory and conducting the first reported drone attacks on the Caspian Sea, while a mass fixed-wing UAV wave was claimed intercepted across nine Russian federal subjects.

All seven events in this period are unconfirmed and single-sourced unless noted; treat the following as provisional.

Deep-strike on Tyumen energy infrastructure: Two separate unconfirmed reports describe Ukrainian drones striking the Antipinsky Oil Refinery in Tyumen — a target approximately 1,700 km from the front line. One account, corroborated by the regional governor, Zelensky, and the AFU General Staff (three sources), describes a fire at the Tyumen refinery confirmed by official acknowledgment on both sides, making this the most substantively supported event in the period. This represents a significant extension of Ukraine's deep-strike reach beyond prior observed patterns; Tyumen has no prior baseline in the 7-day record.

Caspian Sea strikes: Two unconfirmed reports describe Ukrainian OWA-UAV attacks in the Caspian Sea near Astrakhan, targeting sanctioned Russian-flagged vessels (PORT OLYA 2, BEGEY), oil platforms, and a Tarantul-class missile boat. Separately, Iran's Foreign Minister (three sources) condemned a Ukrainian strike on an Iranian commercial vessel in the Caspian, demanding UN Security Council accountability. No prior Caspian baseline exists.

133-UAV intercept claim: Russian MoD and a corroborating single-source report claim 133 fixed-wing UAVs were intercepted across Belgorod, Bryansk, Kaluga, Kursk, Oryol, Rostov, Smolensk, Moscow, Krasnodar, Crimea, and the Black Sea overnight. Both accounts are unconfirmed.

Kirov defense plant strike: An unconfirmed, single-sourced report describes a strike on the Avitec defense enterprise in Kirov, with the governor acknowledging 5 killed and 26 wounded. Local sourcing alleges significantly higher casualties; figures are unverified.

Crimea: One unconfirmed report includes strikes on a Chornomornaftohaz gas storage facility and a drone relay station near Chornomorsk.

If provisionally accepted, the Tyumen refinery strike signals a Ukrainian capability and willingness to strike critical energy infrastructure at extreme range inside Russia, beyond previously observed deep-strike patterns. The Caspian events — if confirmed — would represent a novel operational domain for Ukrainian strike activity and carry significant diplomatic weight given the potential involvement of Iranian assets and Iran's formal protest. A Tarantul-class missile boat kill, if verified, would constitute a notable naval loss. The Avitec strike, if confirmed at scale, would indicate pressure on Russian defense industrial output in the Volga-Ural region.

Watch for independent corroboration of the Tyumen refinery fire via satellite imagery or commercial flight data, which would indicate confirmed damage to a strategically significant energy node. Monitor Iranian diplomatic channels and UN Security Council communications for escalation signals tied to the Caspian vessel incident. Watch for Russian MoD or regional governor statements on Kirov casualty figures, which would indicate the true scale of the Avitec strike. Any follow-on reporting of Caspian Sea vessel movements or platform damage would indicate the operational scope of Ukraine's maritime drone reach. Continued absence of verified sourcing across all seven events should be treated as an indicator of active information suppression or early-stage reporting.

Sudanese Armed Forces launched a multi-pronged ground offensive in North Kordofan, claiming recovery of Bara, Jabra al-Sheikh, and Umm Siyala from the RSF — the first major ground operation in the area in several weeks, per single-sourced reporting. All events for the period are unconfirmed.

North Kordofan (no prior baseline, 4 events): Two single-source and unconfirmed reports describe an SAF advance from the Rahid al-Nuba axis, seizing Umm Sayalla and Barah, with a subsequent SAF statement claiming the additional recovery of Jabra al-Sheikh and Umm Siyala. One event with two sources corroborates the Bara recapture and notes that key supply routes toward El Obeid were reopened. A separate UN Women report flags daytime drone strikes on El Obeid as forcing civilians — particularly women — away from water collection points, compounded by humanitarian funding cuts closing relief operations in the area.

Red Sea off Al Hudaydah (up ~400% vs. 7-day average of 0.4 events/day, 2 events): UKMTO reported a projectile striking an oil tanker approximately 70 nautical miles from Al-Shaqiq, Saudi Arabia. Separately, Houthi media claimed strikes on Saudi Aramco oil facilities along the Red Sea coast. Both reports are single-sourced and unconfirmed; no damage or casualty details are available.

Al-Qadarif (no prior baseline, 1 event): A single-sourced, unconfirmed report describes a herder killed and hundreds of cattle looted by Shifta gangs on the Sudan-Ethiopia border.

If the North Kordofan advances are substantiated, SAF has shifted the lines of control in a strategically significant corridor and restored logistics access to El Obeid — the state capital under sustained RSF pressure. The Red Sea tanker strike, if confirmed, extends the Houthi maritime interdiction pattern into the Al-Shaqiq zone, a known energy infrastructure node.

Watch for independent corroboration of SAF territorial claims in North Kordofan; confirmation would indicate a meaningful shift in RSF-SAF front lines and potential pressure on RSF supply lines in the region. Monitor for damage assessments or satellite imagery related to the Red Sea tanker strike and any Saudi Aramco facility reporting, which would indicate escalation in Houthi maritime and infrastructure targeting. In Al-Qadarif, watch for follow-on cross-border incident reports, which would indicate a pattern rather than an isolated event.

Iran's IRGC escalated maritime pressure in the Strait of Hormuz by halting four vessels in 24 hours with warning shots, while a U.S. base in Erbil was reportedly struck — both events are provisional and require corroboration.

Strait of Hormuz (Hormozgan Province): A partial-confidence report corroborated by two sources indicates IRGC naval forces stopped four commercial vessels from transiting the strait's southern corridor, firing warning shots and declaring the route an "unsafe passage." This represents a notable operational posture shift versus the baseline of 1.1 events/day in Hormozgan Province, which had not previously included active vessel interdiction with warning fire in the current period.

Erbil, Kurdistan Region, Iraq: Three sources, as aggregated by Tasnim News, report that a U.S. military base in Erbil was targeted. No weapon type, casualties, or responsible actor has been identified. This is provisional. The Kurdistan Region baseline sits at 0.4 events/day; a single event in this period represents a 150% spike against that average, though the sparse sourcing limits analytical weight.

The Hormuz interdiction, if confirmed, signals a deliberate IRGC attempt to enforce a disputed corridor designation — directly affecting commercial shipping lanes through one of the world's most critical maritime chokepoints. A pattern of vessel stoppages with warning fire would indicate a shift from surveillance posture to active denial operations. The Erbil strike report, while thinly sourced, touches a persistent pressure point between Iranian-aligned actors and U.S. forward presence in northern Iraq.

Watch for additional vessel interceptions or detentions in the Strait of Hormuz, which would indicate the IRGC is enforcing a sustained denial posture rather than a one-off demonstration. Monitor for claim of responsibility or damage assessment from Erbil — attribution would indicate which actor network is active in northern Iraq. Any corroborating imagery or casualty reporting from either location would warrant confidence-level upgrades on both partial events.

Lithuania activated precautionary military protection of critical infrastructure on 21 July, coinciding with a single-sourced report of NATO reconnaissance activity along Kaliningrad's borders; both events are unconfirmed and no kinetic incidents have occurred in the period.

No verified or partial-confidence events were recorded for the NATO_FLANK theater in this period. Two unconfirmed, single-source events emerged on 21 July with no prior baseline for comparison in either location.

First, Lithuanian armed forces were deployed to guard the Klaipėda LNG terminal and other critical national infrastructure. The move was framed publicly as precautionary, following warnings from President Nausėda and regional leaders regarding potential Russian provocations. No incident at the terminal is reported. This event is single-sourced and unconfirmed.

Second, a TASS-cited source claimed a NATO reconnaissance aircraft flew along the Kaliningrad–Poland border and subsequently transited the region's eastern and northern border areas. No NATO airspace violation is described. This event is single-sourced, originates from a Russian state media outlet, and is unconfirmed.

Taken together, the two unconfirmed reports suggest an elevated perception of threat around the Kaliningrad exclave and the Baltic littoral. A precautionary infrastructure-protection deployment in Lithuania — even without a triggering incident — signals that regional leadership assessed the threat environment as sufficiently elevated to justify visible military presence at a high-value energy node. The Klaipėda LNG terminal is a strategic chokepoint for Baltic energy security.

Watch for corroborating reports on the Lithuanian infrastructure deployment from additional independent sources, which would indicate an upgrade in confidence from unconfirmed. Monitor Lithuanian and Polish defense ministry communications for any formal threat advisories. Watch for additional flight-tracking or ADS-B data that could corroborate or refute the Kaliningrad border reconnaissance claim. Any reported incident at Baltic energy infrastructure would indicate escalation beyond the current precautionary posture.

A single-source, unconfirmed report alleges a major cyber intrusion against Israeli Military Industries Company (IMCO), with no verified events recorded in the theater during this period.

The 24-hour period produced zero verified or partial-confidence events. The sole entry in the event record is a single-sourced, unconfirmed claim that a group identifying itself as "Cyber Support Front" breached IMCO, allegedly exfiltrating approximately 30 terabytes of data — of which 10 terabytes are described as ultra-sensitive military documents — and disrupting industrial infrastructure. IMCO is reported to have acknowledged "a severe security incident" and activated a crisis team with foreign expert support. This event carries no baseline comparator; Israel (unspecified district) had no prior event rate in the 7-day baseline. The Aqaba Governorate baseline (0.1 events/day) saw no activity this period.

If substantiated, a breach of this scale at a defense-industrial entity would represent a significant intelligence and operational security exposure. IMCO produces military hardware and systems; compromise of technical documentation at this volume could have downstream implications for platform security and procurement counterintelligence. The reported involvement of foreign containment experts, if confirmed, would suggest the incident exceeded internal response capacity.

Watch for independent corroboration of the IMCO breach claim from Israeli government sources, cybersecurity firms, or additional media outlets — confirmation would indicate the single-source report has evidentiary basis. Monitor for IMCO operational disruptions or official Israeli defense-sector statements. Any data release by "Cyber Support Front" on known leak channels would indicate the exfiltration claim is credible and escalating.

A single-source, unconfirmed report describes a PDF attack on a regime checkpoint in Magway Region near the Naypyidaw–Magway highway — the period's only recorded event, with zero verified or partial items to anchor the picture.

The 24-hour window produced no verified or partial-confidence events against Myanmar. The sole recorded activity is an unconfirmed, single-sourced claim of a clash at the Shwepan checkpoint in Myothit Township, Magway Region, where at least nine regime troops were reportedly killed in a coordinated PDF assault. Magway Region had no prior baseline in the 7-day record (Rakhine State averaged 0.1 events/day), making this a geographic shift rather than an escalation within an established hotspot. Because the event is unconfirmed, it is treated here as a watch item only.

If corroborated, an attack on the Shwepan checkpoint would be operationally significant: the site sits along the Naypyidaw–Magway highway and guards northwestern approaches to the capital. PDF activity at this node would suggest an extension of pressure toward Naypyidaw's logistical corridors, distinct from the Rakhine-centric pattern of recent weeks. No verified data currently supports that assessment.

Watch for independent corroboration of the Shwepan checkpoint claim from additional sources; confirmation would indicate an active PDF front opening in Magway Region. Monitor regime force movements along the Naypyidaw–Magway highway, which would indicate whether the military perceives a sustained threat to that corridor. Any further unconfirmed reports from Myothit Township in the next 72 hours would warrant elevated scrutiny of this emerging geographic vector.

Israeli forces deployed tear gas against Palestinians and journalists in Tal, Nablus, marking the only recorded incident in the 24-hour period and representing a 150% spike above the West Bank — Nablus baseline.

Activity in West Bank — Nablus ran above the 7-day average (0.4 events/day). One verified incident — corroborated across three independent sources — occurred at 21:08 UTC on 25 July in Tal, Nablus. Israeli troops directed tear gas at Palestinians and journalists present at the scene of a deadly shootout that had occurred the previous day. No events were recorded in Gaza City, Khan Younis, Jenin, Jerusalem District, or the broader Gaza Strip during the period.

The incident indicates a continued Israeli security posture in Tal following the prior day's lethal exchange, with force now directed at media personnel documenting the aftermath. Targeting journalists at a post-incident scene carries implications for press access and on-the-ground reporting in the Nablus area. The elevated tempo in Nablus relative to the 7-day baseline, while based on a single verified event, is consistent with a localized escalation cycle following a deadly confrontation.

Watch for follow-on security operations in the Tal-Nablus area, which would indicate an extended Israeli cordon or escalating enforcement posture. Monitor for further restrictions on journalist movement near the site, which would indicate deliberate access denial. Track whether any other West Bank districts — particularly Jenin, which sits near baseline — record upticks, which would indicate spillover beyond the immediate Nablus corridor.

Israeli ground forces conducted a provisional-confidence incursion into the Yarmouk Basin in Daraa governorate on 26 July, marking a notable spike against an otherwise quiet baseline for southern Syria.

Daraa recorded one movement event in the 24-hour period against a 7-day baseline of 0.1 events/day — a tenfold increase in activity tempo. The single event, rated partial confidence across two sources, describes Israeli forces entering the Yarmouk Basin area accompanied by drone flights overhead and the distribution of warning leaflets to local residents. No verified events were recorded for the period. Homs remained at baseline with no reportable activity.

The Yarmouk Basin sits along the Israeli-Syrian boundary in southwestern Daraa, an area of established Israeli operational interest since the post-2024 Syrian transition. A ground incursion paired with leaflet distribution is a tactically deliberate combination: leaflets signal an intent to manage civilian presence, while concurrent drone coverage suggests reconnaissance or overwatch activity. Even at partial confidence, this pattern is consistent with Israeli buffer-zone enforcement operations previously documented in the area. The absence of corroborating verified sourcing limits analytical weight, but the two-source partial rating warrants close attention.

Watch for additional sourcing that would upgrade or downgrade the Yarmouk Basin incursion to verified or unconfirmed status. Monitor for follow-on Israeli ground or air activity in Daraa that would indicate an expanded operational footprint rather than a limited incursion. Any resident displacement or humanitarian movement out of the Yarmouk Basin area would indicate that leaflet warnings produced population effects. Track official Israeli and Syrian Transitional Government statements, which would indicate how either party frames the incursion politically.