Daily Brief No. 11 — 19 July 2026

Covers the 24 hours ending 04:30 Pacific Time, Sunday 19 July 2026

The deaths of two U.S. soldiers in Jordan — the first confirmed U.S. combat fatalities of the renewed war — combined with an eighth consecutive night of U.S. strikes on Iran and Tehran's declaration that the June memorandum is suspended indicate the U.S.-Iran conflict has almost certainly entered a sustained escalatory phase with no active diplomatic off-ramp.

Key Judgments

The deaths of two U.S. soldiers in Jordan — the first confirmed U.S. combat fatalities of the renewed war — plus an eighth consecutive night of U.S. strikes and Iran's declaration that the June memorandum of understanding is 'suspended' indicate the U.S.-Iran conflict has almost certainly entered a sustained escalatory phase with no active diplomatic off-ramp. (high confidence)
Iranian missile and drone strikes on Kuwaiti oil infrastructure and Bahrain, alongside continued IRGC ship interceptions in a functionally closed Strait of Hormuz, indicate the war is likely consolidating into a region-wide campaign against Gulf partner energy and maritime targets, raising escalation risk for Gulf Cooperation Council states. (high confidence)
Ukraine's maritime interdiction campaign is likely now degrading Russian front-line capability directly — ISW reports elite Russian drone units being diverted to fleet protection — compounding documented refining losses and reinforcing the judgment that Moscow's strategic-material position is eroding faster than its battlefield rhetoric admits. (moderate confidence)
The first nationally coordinated day of protest against AI data centers — 142 rallies across 42 states — signals that AI infrastructure siting has likely matured into a durable, cross-partisan U.S. political constraint with midterm salience. (moderate confidence)
Reported operational embedding of commercial AI models (Claude Code, DeepSeek) inside live PRC-aligned espionage intrusions suggests AI-enabled offensive tradecraft has likely moved from forecast to observed practice, though the attribution rests on a single research firm and remains unverified. (low confidence)

Intelligence & National Security

The first confirmed U.S. combat deaths of the renewed Iran war — two soldiers killed and one missing after an Iranian attack in Jordan — have almost certainly locked in a sustained escalatory phase, with the U.S. striking Iran for an eighth consecutive night and Tehran declaring the June war-ending memorandum suspended.

CNN reported (July 19 live coverage) that the U.S. struck Iran for the eighth consecutive night, with explosions reported by Iran's state-run IRNA in Bandar Abbas and on Qeshm Island, after U.S. Central Command (CENTCOM) vowed to 'swiftly punish' Tehran for an attack in Jordan that killed two U.S. service members and left one missing in action; CENTCOM confirmed completion of new strikes in a public release. Fox News reported these are the first confirmed U.S. combat fatalities since the current conflict resumed. Al Jazeera reported Iran now says the June memorandum of understanding with Washington is 'suspended.' CNN reported the U.S. Embassy in Jordan said the international airport and seaport in Aqaba were evacuated over a 'specific and credible threat,' and that President Trump has been presented options for expanding the operation, saying strikes will 'continue until I say it's enough.' CBS News confirmed the eighth straight night of strikes and the two deaths with a third service member missing.

Combat deaths of U.S. personnel remove the strongest remaining political brake on escalation; combined with Iran's formal suspension of the memorandum of understanding and Trump's stated intent to intensify strikes — including hints at civilian-infrastructure and energy targets — the conflict is almost certainly entering a deeper phase with no active diplomatic off-ramp. The Aqaba evacuation indicates the threat envelope now explicitly includes Jordanian civilian infrastructure.

Watch: Retaliation for the Jordan deaths beyond strikes already conducted; any U.S. move against Iranian leadership or energy-export targets; further attacks on U.S. basing in Jordan and the Gulf.

Priority: 1 · Confidence: high

Iranian ballistic-missile and drone strikes on a Kuwaiti oil-sector site and fresh attacks on Bahrain — alongside IRGC claims of intercepting four more ships in the Strait of Hormuz — indicate the war is likely consolidating into a region-wide campaign against Gulf partner energy and maritime infrastructure.

Fox News reported the Kuwait Petroleum Corporation said one of its 'vital sites in the oil sector' suffered 'severe material losses' and injuries in repeated Iranian attacks Saturday, and Kuwait's military said it intercepted hostile ballistic missiles and drones in its airspace; Reuters satellite imagery showed smoke near an oil facility in Kuwait's Ahmadi Governorate. ABC News reported Bahrain's Interior Ministry confirmed air-raid sirens Sunday morning and the Bahrain Defence Force confirmed fresh Iranian aerial attacks, and that the IRGC (Islamic Revolutionary Guard Corps) claimed to have intercepted four ships in the Strait of Hormuz. CNN reported that only six vessels transited the strait in a recent 24-hour period per MarineTraffic data, and that Iran has shown no willingness to cede control of the waterway.

Striking a Gulf Cooperation Council member's oil infrastructure crosses a threshold Tehran had mostly avoided at scale; it is likely intended to internationalize costs and pressure Washington via its partners. With the strait functionally closed and interceptions continuing, the maritime blockade-counterblockade dynamic is hardening rather than resolving.

Watch: Attacks on Saudi or Emirati energy nodes; GCC states invoking collective-defense language; further ship seizures or strikes on vessels.

Priority: 1 · Confidence: high

Ukraine's overnight strike on 13 more Russian shadow-fleet vessels — with ISW assessing the maritime campaign is forcing Russia to divert elite drone units from the front line — indicates Kyiv's interdiction strategy is likely imposing compounding operational, not just economic, costs on Moscow.

Ukrinform reported that during the night of July 18 Ukraine's Unmanned Systems Forces struck 13 vessels of Russia's shadow fleet in the Black Sea and Sea of Azov — eight dry cargo ships, a tanker, a gas tanker, a tugboat, and two floating cranes — and that Ukrainian forces also hit two Russian tankers, the Svetlyak patrol ship, an oil terminal, and the Slavneft-YANOS oil refinery. The Institute for the Study of War (ISW) assessed that continued Ukrainian strikes against vessels in the Black Sea and Sea of Azov are reportedly compelling Russia to divert elite drone units from the front line and are hampering Russian energy and agricultural logistics; ISW also noted Ukrainian strikes overnight July 17–18 on two logistics facilities of Wildberries, Russia's largest online retailer, and on Russian oil and energy infrastructure.

Diversion of elite drone units to fleet protection is the first reported evidence that the maritime campaign is directly degrading Russian front-line capability; combined with sustained refinery strikes, Ukraine is likely executing a coherent strategy to attack the logistics connective tissue between the Russian economy and the front. Strike counts originate with Ukrainian official channels and cannot be fully independently confirmed.

Watch: ISW documentation of which drone units have been redeployed; Russian countermeasures for Azov–Black Sea shipping; insurance and port-activity data at Novorossiysk.

Priority: 2 · Confidence: high · citation unresolved

War — ukrinform.net
Russian Offensive Campaign Assessment, July 18 | Critical Threats — criticalthreats.org

ISW's finding that Gerasimov's claimed Donetsk advances are uncorroborated — against Kyiv Post reporting that Russia gained just 623 square kilometers in the first half of 2026 at tens of thousands of casualties per month — reinforces the judgment that Russia's strategic-material position is eroding faster than its battlefield rhetoric admits.

ISW reported that Russian Chief of the General Staff Valery Gerasimov again 'aggrandized' Russian battlefield advances in Donetsk Oblast on July 18, with several claims not corroborated by any available evidence, and that neither side made confirmed advances on July 18. Kyiv Post reported (July 18) that Russian forces gained only 623 square kilometers in the first half of 2026, that June cost roughly 39,500 casualties for 30 square kilometers, that long-range Ukrainian attacks have hit 25 refineries representing 82% of national refining capacity with June refining down 25%, and that Crimea's rail traffic has collapsed from 94 trains daily to 4.

The convergence of uncorroborated command claims, extreme casualty-to-territory ratios, documented refining losses, and tightening domestic control is consistent with the prior assessment that Moscow is optimizing for positional attrition it cannot indefinitely sustain. Some figures (territorial gain, casualty ratios) originate with Ukrainian-aligned sources and cannot be independently verified.

Watch: Authenticated evidence on Black Sea Fleet contingency planning; Russian fuel-rationing measures; further regime-friendly polling on Putin's approval.

Priority: 2 · Confidence: moderate · single-source

Russian Offensive Campaign Assessment, July 18 | Critical Threats — criticalthreats.org
Putin Just GUTTED Russia to Keep His War Alive — kyivpost.com

Maritime-intelligence firm Windward's flagging of 106 vessels as potential U.S.-blockade breakers — including a covert ship-to-ship crude-transfer network going AIS-dark off Fujairah and Sohar — indicates a durable sanctions-evasion architecture is likely consolidating around the Hormuz blockade.

Windward's daily intelligence product (updated within the window) reported 106 vessels met potential blockade-breaker criteria in its latest daily pull across the Arabian Gulf, Gulf of Oman, and Arabian Sea — 55 carrying fraudulent or high-risk-compliance flags and 42 flying the Iranian flag — with 42 of the flagged vessels within roughly 240 nautical miles of the blockade line. Windward reported a covert ship-to-ship transfer network has reportedly been moving Gulf crude since early May, with tankers switching off AIS (Automatic Identification System) transponders near Fujairah, UAE and Sohar, Oman during transfers; AIS-dark tanker counts in the Arabian Sea ran at 42 in 24 hours versus a typical 33; and imagery showed two already-sanctioned tankers idling near Larak Island alongside an unidentified dark vessel while Kharg Island terminal berths stand down.

Dark-fleet adaptation of the kind that blunted Russia oil sanctions is likely reconstituting around the Iran blockade; if the network scales, blockade enforcement will increasingly depend on interdiction at sea rather than deterrence, raising incident risk. Single commercial-vendor sourcing; methodology is AIS-based and the vendor acknowledges undercounting.

Watch: U.S. interdictions of flagged vessels; sanctions designations of ship-to-ship-network tankers; sustained rise in dark activity beyond this week, which Windward says would indicate a structural shift.

Priority: 2 · Confidence: moderate · single-source, citation unresolved

Strait of Hormuz | Windward Daily Intelligence — insights.windward.ai

Espionage & Counterintelligence

Hunt.io's finding that China-linked operators embedded Claude Code and DeepSeek directly into live intrusions against Taiwanese and Thai government systems suggests commercial AI models have likely crossed from research aids to operational components of PRC-aligned espionage tradecraft.

Security Affairs reported that Chinese actors used Claude Code and DeepSeek to automate attacks that breached government systems, with research firm Hunt.io notifying affected organizations and national CERTs on July 6 and holding publication for a seven-day disclosure window. Cybersecurity News reported that operator logs recovered from TencShell command-and-control infrastructure showed a programmatic division of labor — Claude Code handling agentic tool interaction and command execution, DeepSeek-v4-pro in analytic roles — across 13 servers on four Hong Kong autonomous system numbers; dedicated working directories were tailored to Taiwan-based intelligence requirements, and in Thailand attackers exfiltrated a government database holding names, national ID numbers, and job titles of government employees. The researchers said simplified-Chinese developer logs, Hong Kong infrastructure, and targets mirroring state intelligence mandates 'strongly support' a China-based grouping, echoing Anthropic's November 2025 advisory on a China-linked actor orchestrating automated intrusions.

This is the most detailed public evidence to date of adversary operationalization of commercial frontier models inside live espionage intrusions. Attribution rests on circumstantial indicators from a single research firm and stops short of naming a service (MSS — Ministry of State Security — or PLA, People's Liberation Army). Note: underlying reporting published July 15–16, just outside the strict 24-hour window; surfaced under the PRC standing collection priority because it was not covered in prior editions.

Watch: Corroboration by Anthropic, Google/Mandiant, or Microsoft; CERT advisories from Taiwan or Thailand; evidence of similar LLM-in-the-loop tradecraft by named PRC APT (Advanced Persistent Threat) groups.

Priority: 1 · Confidence: moderate · single-source, unverified

Claude Code and DeepSeek Powered Chinese Cyber Espionage Campaign — securityaffairs.com
Chinese Hackers Embed Claude Code and DeepSeek in AI-Powered Government Cyberattacks — cybersecuritynews.com

Kyiv Post's report that intelligence briefings on Ukraine's deep-strike campaign left Trump 'deeply impressed' and shifted him toward stronger support — if accurate — would mark a consequential case of battlefield-intelligence reporting directly moving U.S. policy.

Kyiv Post reported (July 18) that President Trump has changed his attitude toward Ukraine, signaling stronger support after intelligence briefings left him deeply impressed by Kyiv's long-range strikes deep into Russia. The report, from Kyiv Post special correspondent Jason Jay Smart, situates the shift alongside data on Russia's first-half 2026 territorial gains of 623 square kilometers and Ukrainian strikes on 25 refineries representing 82% of Russian refining capacity.

A single Ukrainian outlet's characterization of the president's private briefing reactions, without named sources or U.S. corroboration; treat as unverified. If corroborated by U.S. reporting, it would help explain any near-term shift in U.S. weapons-release or intelligence-sharing posture toward Kyiv even while Washington is consumed by the Iran war.

Watch: Corroboration from U.S. outlets; concrete policy indicators such as new weapons packages, deep-strike enablement, or public statements.

Priority: 2 · Confidence: low · single-source, unverified, anecdotal

Putin Just GUTTED Russia to Keep His War Alive — kyivpost.com

The SBU's detention of a heating-network engineer who allegedly worked simultaneously for Russia's FSB and GRU to adjust strikes on Sloviansk illustrates that Russian services are likely running overlapping, redundantly-tasked agent networks in Ukraine's frontline cities.

Ukrainian outlet UNN, citing the Security Service of Ukraine (SBU), reported that SBU counterintelligence detained an agent in Donetsk Oblast who worked simultaneously for the FSB (Federal Security Service) and GRU (Russian military intelligence) — a local heating-network engineer who used work trips around Sloviansk to identify Ukrainian Defense Forces locations and transmit coordinates for missile, bomb, and drone attacks. UNN reported the man was recruited via a Telegram channel administered by an employee of the Smolensk Military Hospital who scouted candidates for Russian intelligence, and that he was charged with high treason under martial law, facing life imprisonment. UNN also reported the SBU separately detained two agents in Dnipropetrovsk region who directed strikes on regional energy infrastructure, including a key thermal power plant.

Dual FSB-GRU tasking of a single low-level agent is unusual in public SBU case reporting and suggests either inter-service resource competition for targeting data or deliberate redundancy; utility-worker cover remains a recurring pattern for strike-spotting recruitment. Sourcing is the SBU itself via a single Ukrainian outlet and cannot be independently verified.

Watch: Further SBU announcements indicating cross-service Russian agent handling; targeting patterns around Sloviansk consistent with lost spotter coverage.

Priority: 3 · Confidence: moderate · single-source

Adjusted shelling of Sloviansk - SBU detained a double agent of the FSB and the GRU | УНН — unn.ua

Technology & AI

The first nationally coordinated day of protest against AI data centers — 142 rallies across 42 states organized by Tea Party-veteran-led HumansFirst — indicates local resistance to the AI buildout has likely matured into a national political movement with midterm salience.

Reuters reported that opponents of the data-center buildout held 142 protests across 42 states on Saturday July 18, the first nationwide coordinated action, organized by HumansFirst, a group co-founded by former Tea Party leader Amy Kremer, who predicted data centers will be a defining issue in November's midterms and the 2028 presidential race; Texas led with 16 protests, Georgia had 11, and California, Florida, and Pennsylvania seven each. Reuters reported a June Reuters/Ipsos poll found just a third of Americans approve of the pace of data-center construction and only 14% would support a data center in their own community; attendance was lower than expected in some rural areas and major cities, per local organizers. Organizer demands include development transparency, resource protections, union jobs, and binding developer accountability.

Cross-partisan, locally-rooted opposition with national coordination is the profile of a durable political constraint; combined with New York's permit moratorium and 300-plus state bills, siting risk is likely becoming a material input to hyperscaler capex planning alongside power and water.

Watch: Whether protests convert into state legislation or permit denials; candidate positioning on data centers ahead of the midterms; industry counter-mobilization.

Priority: 2 · Confidence: high

US Data Center Protests Go National as Backlash Grows — usnews.com
Data center opponents stage 142 protests across 42 US states | 95.5 WIFC — wifc.com
National Day of Data Center Protests — Humans First — humansfirst.com

Publication of a working proof-of-concept for the 'wp2shell' WordPress-core exploit chain — anonymous HTTP request to remote code execution on bare installs — makes mass exploitation of unpatched sites highly likely in the coming days.

The Hacker News reported (updated July 18) that the two WordPress core flaws known as wp2shell now carry CVE IDs — CVE-2026-63030, a REST API batch-route confusion, and CVE-2026-60137, a SQL injection in core — which chained together take an anonymous HTTP request to code execution on a bare WordPress install with zero plugins. The outlet reported every 6.9 and 7.0 site was exposed until WordPress shipped 6.9.5 and 7.0.2 on Friday and enabled forced updates through its auto-update system, that the full mechanism has been published, and that a working proof-of-concept is now public on GitHub; the batch-route bug was found by Adam Kues at Assetnote.

Core-level pre-authentication remote code execution in the web's most widely deployed CMS with a public proof-of-concept is a near-certain mass-exploitation event for sites with auto-updates disabled; expect botnet-scale scanning within days. Forced updates will blunt but not eliminate exposure, particularly for enterprise-managed and air-gapped deployments.

Watch: In-the-wild exploitation reports; CISA KEV (Known Exploited Vulnerabilities) listing; compromise of high-profile sites.

Priority: 2 · Confidence: high · citation unresolved

The Hacker News | #1 Trusted Source for Cybersecurity News — thehackernews.com

Bloomberg's report that China's National AI Industry Investment Fund took voting rights in DeepSeek's $7.4 billion round — while Tencent and JD received none — indicates Beijing is likely formalizing direct state governance over its frontier AI champions.

Bloomberg reported, per Techmeme's July 18 aggregation and citing sources, that China's National AI Industry Investment Fund gained voting rights in DeepSeek by joining its $7.4 billion funding round, while other investors including Tencent and JD received none. Techmeme's aggregation the same day carried a Reuters report that a Chinese filing implies DeepSeek is valued at around $52 billion, and a Wall Street Journal report that China's National Data Administration says daily AI token consumption in China hit 140 trillion in March 2026, up from 100 trillion in December 2025.

Differential voting rights for a state fund — denied to private strategic investors — is a governance structure, not a passive investment; it extends the Party-state's established golden-share playbook to frontier AI and sharpens the question of state direction behind Chinese open-weight releases now diffusing globally. Single-source (Bloomberg) on the voting-rights detail.

Watch: Confirmation in Chinese corporate filings; similar state-fund stakes in Moonshot AI or other frontier labs; U.S. policy response tying export controls to state-governed labs.

Priority: 2 · Confidence: moderate · single-source

Techmeme: Sources: China's National AI Industry Investment Fund gained voting rights in DeepSeek by — techmeme.com

World & US Developments

Today's Spain-Argentina World Cup final at MetLife Stadium — with President Trump, Mexico's president, and Spain's king attending under SEAR-1 security amid an active U.S.-Iran war and fresh Iranian threats — concentrates the year's highest-consequence mass-gathering risk into a single afternoon.

CBS New York reported barriers were in place outside MetLife Stadium early Saturday amid a heavy police presence, that President Trump will attend Sunday's final along with several international heads of state including Mexico's president and Spain's king, and that more than 80,000 fans are expected for the 3 p.m. kickoff. ABC7/AP reported the Host Committee confirmed the final is designated a SEAR 1 (Special Event Assessment Rating Level 1) event with significantly enhanced security and expected road closures, gates opening at 11 a.m. and fans urged to be seated by 1:30 p.m.; the final features the first-ever World Cup halftime show, with FIFA saying performers include BTS, Justin Bieber, Madonna and Shakira. Iranian adviser Mohsen Rezaei's threat this week that 'no political border will be secure against Iran's offensive forces' (per Fox News) frames the threat backdrop.

Presidential attendance plus multiple foreign heads of state at an 80,000-plus-seat venue during active hostilities with a state that has explicitly threatened operations beyond the region makes this the peak single-point security risk of the year; the security architecture (SEAR-1, drone interdiction, layered perimeters) is correspondingly the most extensive ever applied to a U.S. sporting event.

Watch: Any airspace violations or drone incidents near East Rutherford; credible threat reporting during the event window; post-event crowd-management incidents.

Priority: 1 · Confidence: high

Venezuela's confirmed earthquake death toll approaching 5,000 — with the UN estimating up to 50,000 still missing — indicates the June 24 twin quakes will likely rank among the hemisphere's deadliest disasters and are becoming a sanctions-policy flashpoint in Washington.

Al Jazeera reported (July 16) that confirmed deaths from the June 24 twin earthquakes rose to 4,930 per lawmaker Jorge Rodriguez, with nearly 17,000 wounded, 21,120 in shelters, and the UN estimating as many as 50,000 people still missing; displaced residents told Al Jazeera the state response has been slow. Al Jazeera also reported 14 Democratic U.S. lawmakers sent a letter urging the White House to ease economic sanctions on Venezuela to aid recovery. CNN's earlier reporting documented a forensic pathologist's claim that official tolls represent 'not even a third' of actual deaths, and NASA satellite data suggesting close to 59,000 destroyed buildings versus the government's count of 850-plus.

The gap between official tolls, UN missing estimates, and independent damage data means the true toll is likely several times the confirmed figure; the disaster is compounding an existing humanitarian crisis and creating pressure on U.S. sanctions policy during Venezuela's political transition. Toll figures are from July 16 reporting — the most recent authoritative update — on a continuing story.

Watch: Updated casualty figures; U.S. decision on sanctions relief; disease outbreaks in shelter populations.

Priority: 2 · Confidence: moderate · conflicting-reports

A lawyer going public with sexual misconduct claims against the ICC chief prosecutor — who denies the allegations — will likely intensify pressure on a court already navigating politically charged caseloads.

CNN published an exclusive (carried on its world page within the window) reporting that a lawyer has gone public with sexual misconduct claims against the International Criminal Court (ICC) chief prosecutor, and that he denies the allegations. Details beyond CNN's initial reporting were not available at compile time.

Single-outlet reporting on unadjudicated allegations; included for awareness given the ICC's role in active war-crimes caseloads (Ukraine, Gaza) where prosecutorial credibility carries geopolitical weight. Treat as unverified pending corroboration and any formal ICC oversight response.

Watch: ICC Assembly of States Parties or Independent Oversight Mechanism response; corroborating reporting from other outlets.

Priority: 3 · Confidence: low · single-source, unverified, citation unresolved

World news - breaking news, video, headlines and opinion | CNN — cnn.com

A U.S. citizen working in the Democratic Republic of Congo testing positive for Ebola signals the outbreak — already past 2,000 cases — likely retains cross-border and expatriate exposure potential.

CNN reported (world page, within the window) that a U.S. citizen working in the Democratic Republic of Congo has tested positive for Ebola. Prior reporting tracked in this product had the DRC outbreak past 2,000 confirmed cases and 754 deaths, with health workers at the region's largest hospital striking over pay.

An expatriate infection raises the probability of medical evacuation and, with it, U.S. domestic preparedness activity; it is also an indicator of continued transmission in areas with international staff presence. Single-outlet, headline-level reporting at compile time.

Watch: CDC or State Department statements; medical-evacuation decision; outbreak case-curve updates from WHO.

Priority: 3 · Confidence: low · single-source, citation unresolved

World news - breaking news, video, headlines and opinion | CNN — cnn.com

Watchlist

World Cup final kicks off 3 p.m. ET today at MetLife Stadium with President Trump and multiple heads of state attending under SEAR-1 security — watch for airspace/drone incidents and any credible threat reporting during the event window. (24h)
Iranian adviser Rezaei's 'full-scale offensive' ultimatum window (two to three days from July 17) is now expiring — watch for a qualitative Iranian escalation against U.S. forces or Gulf states, or climb-down signaling. (24–72h)
Andy Burnham takes office as UK prime minister Monday — watch first signals on continuity in U.S.-UK intelligence-sharing, NATO, and Ukraine policy. (24–48h)
Mass exploitation of the WordPress 'wp2shell' core RCE chain following the public proof-of-concept — watch for in-the-wild campaigns and a CISA KEV listing. (24–72h)
U.S. district court ruling due by July 22 on state attorneys general's request for a temporary stay pausing the Paramount-WBD merger. (48–72h)

Reading this brief

Phrases such as likely follow ICD 203 estimative-probability language. Confidence tags — High, Moderate, Low — grade source reliability and corroboration and keep the same green / amber / rust coding under every accent theme.

Source families used: wire services and major broadcasters via live pages and syndicated copies (CNN, Al Jazeera, CBS News, ABC News, Fox News, Reuters via U.S. News/WIFC); a CENTCOM public release; Ukrainian official-adjacent outlets (Ukrinform, Kyiv Post, UNN) and ISW assessments (Critical Threats/Kyiv Post); commercial maritime intelligence (Windward); cybersecurity trade press (The Hacker News, Security Affairs, Cybersecurity News); Techmeme aggregation for technology. Estimative language follows ICD 203 conventions; confidence levels are attached to analytic judgments; all material is drawn from open sources and no privileged sourcing is implied. Direct fetches of reuters.com, apnews.com, bbc.com, and therecord.media are frequently blocked, so syndicated copies were used; date-checking excluded numerous stale results surfaced by search. Standing collection priorities: PRC — covered via the Hunt.io Claude Code/DeepSeek item, whose underlying reporting published July 15–16 (just outside the strict 24-hour window) but was surfaced because it was not covered in prior editions; Israel — no significant new intelligence/CI reporting in this window beyond the Forbidden Stories–Haaretz Pegasus investigation already covered in Edition 10, so no item was forced. Section counts run below target on a relatively thin Sunday news cycle: espionage-ci carries 3 items and tech carries 3 items after two tech candidates (reported SpaceX–DOD data-center-capacity talks; GameStop's disclosed 9.8% eBay stake) were dropped because no specific, verifiable source URL for them was captured in this edition's source registry — dropping under-sourced items was preferred to citing pages that could not be confirmed to support them. Some Ukrainian battlefield figures originate with Ukrainian official or aligned sources and are flagged accordingly; single-source and unverified items are flagged rather than buried, per tradecraft standards.