RFDELTA
RFDELTA Daily Intelligence Brief

Daily Global Threat Matrix

August 2, 2026

This edition is rebuilt from a clean prior-state snapshot and a new live-source collection, not cloned from yesterday's rendered report. The current-source fingerprint changed from the prior run, with 6 signal streams and 35 distinct evidence items. 6 live collectors returned successfully and 7 failed. The ranked matrix therefore reflects day-over-day evidence changes while preserving analyst context that has not been invalidated.

JSONFull reportArchive
Top risk score97.60
Top 3 mean94.68
Sources57
As ofAug 2, 2026, 11:33 AM UTC
Priority score chart for the Daily Global Threat Matrix
Inference Surface

High-value lenses to monitor next

Defense / force posture / weapons flow93.60

Defense Escalation

Flags where military action, air-defense depletion, mobilization, weapons transfer or defense-industrial strain can move markets and operating risk before diplomacy catches up.

Current readRussia–Ukraine reciprocal missile, drone and energy-logistics escalation

Signals

  • missile and drone tempo
  • air-defense inventory pressure
  • forward deployments
  • base alerts

Decision use

Security posture, travel exposure, aerospace demand, logistics rerouting and defense supply-chain monitoring.

Space / satellite services / launch / ISR92.85

Space and Orbital Infrastructure

Turns satellite communications, navigation, earth observation and launch activity into a resilience lens for conflict, disaster response, shipping and financial-market continuity.

Current readTyphoon Bavi creates a new red-level East Asia humanitarian and logistics shock

Signals

  • satellite outage reports
  • GNSS interference
  • launch cadence
  • ISR tasking pressure

Decision use

Continuity planning for navigation, communications, remote sensing, insurance verification and edge operations.

Cyber / enterprise exposure / critical services92.85

Cyber Exploitation

Ranks active exploitation, internet-facing platforms and remediation pressure where the blast radius can cross industries quickly.

Current readActive exploitation broadens from Cisco SD-WAN to SharePoint, Langflow and web platforms

Signals

  • CISA KEV adds
  • critical CVE velocity
  • ransomware disclosures
  • public exploit code

Decision use

Patch sequencing, incident review, third-party risk and board-level operational continuity decisions.

Energy / shipping / insurance / inflation97.60

Energy and Maritime Chokepoints

Identifies where ports, tanker lanes, oil flows, war-risk insurance and strategic reserves can transmit local shocks into global prices.

Current readHormuz ceasefire breakdown and tanker disruption

Signals

  • vessel attacks
  • AIS darkness
  • war-risk premiums
  • port restrictions

Decision use

Freight, fuel, inflation, supplier and treasury hedging awareness.

Geopolitics / sanctions / diplomacy97.60

Geopolitical Flashpoints

Connects diplomatic breakdowns, sanctions, regional coercion and command uncertainty to operating thresholds.

Current readHormuz ceasefire breakdown and tanker disruption

Signals

  • sanction packages
  • ceasefire failures
  • leadership instability
  • military warnings

Decision use

Executive risk framing, legal exposure, market-event watchlists and regional operating posture.

Tariffs / USMCA / aerospace / industrial supply92.58

Trade and Industrial Policy

Surfaces policy cliffs and investigation pathways that can change landed cost, compliance burden and inventory behavior.

Current readU.S. trade-policy cliff expands into aerospace while USMCA renewal remains unresolved

Signals

  • tariff deadlines
  • Section 232 actions
  • USMCA review
  • retaliation risk

Decision use

Procurement timing, price setting, contract clauses and inventory planning.

Outbreaks / health systems / workforce continuity92.50

Public Health and Biosecurity

Separates local humanitarian burden from cross-border continuity risk and health-system strain.

Current readBundibugyo Ebola expands rapidly and produces an exported European case

Signals

  • case acceleration
  • exported cases
  • health-worker infections
  • diagnostic capacity

Decision use

Workforce planning, travel policy, facility preparedness and health-sector exposure.

Storms / floods / earthquakes / logistics92.85

Climate and Disaster Logistics

Prioritizes acute hazards where landfall, flooding, port closure or power disruption can create near-term operational consequences.

Current readTyphoon Bavi creates a new red-level East Asia humanitarian and logistics shock

Signals

  • GDACS alerts
  • USGS feeds
  • evacuation orders
  • port and rail closures

Decision use

Facility continuity, shipping contingency, insurance claims and supplier communication.

Macro / rates / dollar / commodities97.60

Financial Liquidity and Safe-Haven Stress

Translates the threat matrix into liquidity, volatility and safe-haven pressure without pretending it is a trading signal.

Current readHormuz ceasefire breakdown and tanker disruption

Signals

  • oil and gold moves
  • dollar strength
  • Treasury duration
  • credit spread pressure

Decision use

Treasury awareness, counterparty monitoring, capital planning and scenario framing.

AI / semiconductors / cloud infrastructure92.85

AI, Chips and Strategic Technology

Frames export controls, AI tooling exposure, chip supply and data-center dependencies as strategic operating risks.

Current readActive exploitation broadens from Cisco SD-WAN to SharePoint, Langflow and web platforms

Signals

  • AI platform advisories
  • chip export controls
  • cloud outages
  • data-center energy constraints

Decision use

Technology procurement, vendor risk, compute strategy and compliance monitoring.

Power / water / transport / telecom92.85

Critical Infrastructure Continuity

Connects cyber, disaster and conflict signals to practical continuity questions for infrastructure-dependent operations.

Current readTyphoon Bavi creates a new red-level East Asia humanitarian and logistics shock

Signals

  • grid outages
  • water system stress
  • rail and port disruption
  • telecom downtime

Decision use

Business continuity, site prioritization, vendor escalation and executive readiness.

Narratives / elections / institutional trust97.60

Information Operations and Trust

Tracks where narrative pressure, misinformation or institutional trust shocks can amplify otherwise manageable incidents.

Current readHormuz ceasefire breakdown and tanker disruption

Signals

  • coordinated narrative spikes
  • election-adjacent claims
  • official correction cycles
  • social volatility

Decision use

Communications readiness, brand risk, public-affairs posture and stakeholder monitoring.

Crypto / sanctions / terrorist finance / theft88.00

Illicit Finance and Web3

Separates speculative market noise from infrastructure compromise, sanctions exposure and state-linked value transfer.

Current readWeb3 incident frequency and state-linked illicit finance remain elevated

Signals

  • wallet designations
  • exchange freezes
  • bridge exploits
  • signer compromise

Decision use

Compliance monitoring, exchange/custody risk, sanctions screening and treasury controls.

Ranked Matrix

What moves first

#1
geopolitical / energy / maritime / macro

Hormuz ceasefire breakdown and tanker disruption

This threat has reversed the tactical improvement seen in the June 12 run. The key change is not rhetoric alone: commercial-vessel attacks, intermittent military action and impaired transit have converted political uncertainty into an observable logistics shock. The strategic problem is a coordination failure inside Iran combined with uncertain U.S. escalation thresholds. Even if formal negotiations continue, shipowners and insurers respond to demonstrated attack capability rather than diplomatic intent. That creates an asymmetric market structure: a modest diplomatic improvement can lower prices temporarily, but a single verified strike can rapidly reprice crude, freight, war-risk insurance and inflation expectations. The immediate operational test is sustained safe passage, not another ceasefire announcement. [Live-source refresh 2026-08-02] No current source stream produced a corroborating item for this threat. The score is therefore held near the prior run rather than being mechanically increased from stale evidence.

Score
97.60
Delta
0.00
Region
Persian Gulf / Middle East / Global

Observed evidence

  • U.S. officials demanded that Iran publicly guarantee safe passage and stop attacks on ships.
  • Tanker traffic was described as essentially stopped after renewed attacks; some vessels were operating dark.
  • The central route remained affected by mines, with traffic pushed toward Iranian and Omani routes.
  • AP reported WTI near $75.80 and Brent near $79 on July 8, while U.S. emergency stocks were at 319.5 million barrels.

Watch triggers

  • Verified restoration of normal tanker transits for 48 hours
  • Further commercial-vessel strikes or mine incidents
  • Expansion of U.S. or Iranian military operations
  • New IMO, flag-state, insurer or major carrier transit restrictions
S01: Associated PressS02: Associated Press
#2
geopolitical / conflict / energy / defense

Russia–Ukraine reciprocal missile, drone and energy-logistics escalation

The war is moving deeper into a reciprocal infrastructure-denial phase. Russia is exploiting Ukraine's limited ballistic-missile defenses, while Ukraine is increasingly targeting the energy, tanker and refinery systems that support Russian military operations and export revenue. The result is a coupled escalation loop: each side can impose higher economic and logistics costs without producing decisive battlefield movement. The Patriot licensing announcement changes the long-run industrial picture but not the next several months, because production transfer, protected facilities, skilled labor and sensitive components cannot be established quickly. Near-term risk therefore remains dominated by interceptor scarcity, civilian exposure and widening attacks on energy and maritime assets. [Live-source refresh 2026-08-02] No current source stream produced a corroborating item for this threat. The score is therefore held near the prior run rather than being mechanically increased from stale evidence.

Score
93.60
Delta
0.00
Region
Ukraine / Russia / Black Sea / Europe

Observed evidence

  • Russia launched 12 missiles, including six ballistic missiles, and 121 drones overnight into July 11.
  • Ukraine reported damage to 21 Russian oil tankers plus tugboats, cargo ships and a dredger in the Sea of Azov.
  • A July 6 Russian barrage reportedly involved 68 missiles and 351 drones, killing at least 22.
  • A U.S. license for Ukrainian Patriot production is strategically important but unlikely to close the near-term interceptor gap.

Watch triggers

  • Additional ballistic-missile saturation attacks
  • Confirmed sustained reduction in Russian refinery or tanker throughput
  • Black Sea or Sea of Azov shipping restrictions
  • Near-term delivery of Patriot interceptors independent of future licensed production
S03: Associated PressS04: Associated PressS05: Associated Press
#3
environmental / disaster / supply chain

Typhoon Bavi creates a new red-level East Asia humanitarian and logistics shock

Bavi is the most time-sensitive new entrant because the hazard is in the impact window now. The direct humanitarian risk is amplified by a compound-disaster backdrop: parts of China were already managing deadly flooding and damaged water infrastructure before this landfall. The cross-asset market effect will depend less on the storm's peak wind rating than on where rainfall concentrates and how long ports, rail corridors and factories remain offline. A short precautionary shutdown is absorbable; widespread flooding across Zhejiang and neighboring manufacturing zones would create a more persistent supply-chain shock. This item should receive the highest monitoring allocation over the next 24–48 hours even though Hormuz remains the highest systemic risk. [Live-source refresh 2026-08-02] No current source stream produced a corroborating item for this threat. The score is therefore held near the prior run rather than being mechanically increased from stale evidence.

Score
92.85
Delta
0.00
Region
Northern Mariana Islands / Philippines / Taiwan / Japan / China

Observed evidence

  • GDACS classifies Bavi as Red, with 46.4 million people exposed to Category 1 or stronger winds and a maximum observed wind speed of 287 km/h.
  • Zhejiang evacuated more than 1.7 million people; Shanghai moved roughly 34,000 from high-risk areas.
  • At least 17 deaths were reported in the Philippines, while Taiwan reported more than 14,200 evacuations and 113 injuries.
  • Flights, ferries and high-speed rail were disrupted across a major manufacturing and trade corridor already affected by prior flooding.

Watch triggers

  • Landfall location and rainfall totals in Zhejiang/Fujian
  • Port, airport, semiconductor, automotive or container-terminal closures
  • Dam or levee failures after antecedent flooding
  • Extended power outages or inland logistics interruption
S16: Associated PressS17: Global Disaster Alert and Coordination SystemS22: Associated Press
#4
cyber / enterprise / critical services

Active exploitation broadens from Cisco SD-WAN to SharePoint, Langflow and web platforms

The cyber risk has changed shape. The June report centered on a specific network-management ecosystem; the July evidence shows active exploitation distributed across collaboration, AI-workflow and web-content platforms. That broadens the exposed organization set and makes asset discovery more difficult. The SharePoint case is especially important because an available patch does not prove remediation: defenders must verify deployment, check whether compromise occurred before patching, and rotate credentials or secrets if exposure is suspected. Langflow's inclusion is also strategically relevant because rapid adoption of AI orchestration tools can outpace mature access-control and inventory practices. The near-term risk is not one catastrophic zero-day but synchronized exploitation of heterogeneous, publicly reachable systems. [Live-source refresh 2026-08-02] 2 current signal streams contributed 11 source items. Current signal strength is 12.05 versus 10.80 on the prior run, producing a +0.16 day-over-day score move.

Score
92.85
Delta
+0.16
Region
Global

Observed evidence

  • Current-source coverage (2026-08-02): CISA added 3 KEV items in the seven-day lookback, including CVE-2026-20316, CVE-2025-68686, CVE-2026-16812.
  • Current-source coverage (2026-08-02): NVD returned 24 critical CVE records in the seven-day publication window.
  • CISA added actively exploited SharePoint CVE-2026-45659 on July 1.
  • CISA added three more exploited vulnerabilities on July 7 affecting JoomShaper, Langflow and Joomlack products.
  • Microsoft states the SharePoint issue was addressed in May updates, making patch verification and compromise assessment the immediate control problem.

Watch triggers

  • Ransomware or nation-state attribution tied to the new KEVs
  • Mass scanning or public proof-of-concept acceleration
  • Victim disclosures in government, health, energy or financial sectors
  • New emergency directives or materially shortened remediation deadlines
S10: Cybersecurity and Infrastructure Security AgencyS11: Cybersecurity and Infrastructure Security AgencyS12: Microsoft Security Response CenterL20260802-70e030c4b17c: Cybersecurity and Infrastructure Security AgencyL20260802-38caf61f1b6f: Cybersecurity and Infrastructure Security Agency
#5
economic / policy / trade / industrial supply chain

U.S. trade-policy cliff expands into aerospace while USMCA renewal remains unresolved

Trade risk has not disappeared; it has become more distributed and deadline-driven. The aerospace proclamation deliberately starts with negotiations rather than immediate tariffs, but it creates a credible future-action channel affecting aircraft manufacturers, engines, maintenance, cargo and tourism. At the same time, the unresolved USMCA review and the July 24 Section 122 deadline create overlapping policy branches. The most likely near-term impact is not a single universal tariff shock but planning paralysis: importers, manufacturers and transport operators must price several mutually exclusive scenarios. This raises inventory, hedging and contract costs even before a final policy is selected. The score rose, but the rank fell because other threats escalated more abruptly. [Live-source refresh 2026-08-02] No current source stream produced a corroborating item for this threat. The score is therefore held near the prior run rather than being mechanically increased from stale evidence.

Score
92.58
Delta
0.00
Region
United States / Canada / Mexico / Global

Observed evidence

  • The July 9 Section 232 action ordered negotiations over commercial aircraft, jet engines and parts; no immediate tariff was imposed.
  • The proclamation permits alternative remedies after the negotiation period if agreements are not reached or are ineffective.
  • The U.S. did not renew USMCA in its current form on July 1, although the agreement remains in force.
  • The 10% Section 122 global tariff is scheduled to expire July 24 while litigation and replacement-policy questions remain active.

Watch triggers

  • Replacement or extension mechanism for the July 24 Section 122 expiry
  • Outcome of U.S.-Mexico talks during the week of July 20
  • Aircraft-sector negotiating targets, exemptions or threatened tariff rates
  • Retaliatory measures from major aerospace and industrial trading partners
S13: The White HouseS14: Office of the U.S. Trade RepresentativeS15: Associated Press
#6
public health / humanitarian / cross-border

Bundibugyo Ebola expands rapidly and produces an exported European case

This is the largest positive score delta in the report. The outbreak is no longer appropriately characterized as a difficult regional event with limited cross-border spillover. It is now a fast-growing multi-province epidemic with documented exportation to Europe and substantial infection among health workers. The new diagnostic and treatment trial are meaningful response improvements, but they arrive after the outbreak has already expanded at exceptional speed. CDC still assesses U.S. population risk as low, which is consistent with transmission mechanics and infection-control capacity; that low U.S. risk should not be confused with low global humanitarian risk. The decisive variables are case isolation speed, contact follow-up, health-worker protection and whether transmission seeds additional urban or international chains. [Live-source refresh 2026-08-02] No current source stream produced a corroborating item for this threat. The score is therefore held near the prior run rather than being mechanically increased from stale evidence.

Score
92.50
Delta
0.00
Region
DRC / Uganda / France / Regional

Observed evidence

  • WHO reported 1,481 confirmed cases across DRC, Uganda and France and 454 deaths.
  • DRC added 564 confirmed cases and 220 deaths after the June 19 WHO update.
  • A laboratory-confirmed case was detected in a physician who returned to France from DRC.
  • WHO listed the first molecular diagnostic and opened the PARTNERS treatment trial; no approved Bundibugyo-specific treatment currently exists.

Watch triggers

  • Additional exported cases outside the DRC-Uganda transmission network
  • Growth beyond the 36 affected health zones reported by WHO
  • Healthcare-worker infections and treatment-center capacity strain
  • Early safety or efficacy signals from the PARTNERS trial
S06: World Health OrganizationS07: World Health OrganizationS08: World Health OrganizationS09: U.S. Centers for Disease Control and Prevention
#7
web3 / cyber / financial crime / sanctions

Web3 incident frequency and state-linked illicit finance remain elevated

The web3 signal is no longer just a list of isolated smart-contract bugs. The dominant loss mechanism is infrastructure and operational compromise, while smaller application exploits drive a record incident count. That distinction matters for governance: code audits alone cannot mitigate credential theft, social engineering, signer compromise or manipulated operational workflows. State-linked theft and terrorist-finance designations also connect the category directly to sanctions and geopolitical risk. The July exploit is modest compared with April's large attacks, but it confirms that incident flow remains active. Public TRM and Chainalysis research improved measurement, but the public evidence base should be treated as directional rather than a complete transaction-level attribution set. [Live-source refresh 2026-08-02] 1 current signal stream contributed 5 source items. Current signal strength is 9.10 versus 0.00 on the prior run, producing a 0.00 day-over-day score move.

Score
88.00
Delta
0.00
Region
Global

Observed evidence

  • Current-source coverage (2026-08-02): GDELT surfaced 15 recent items for Web3 exploits and illicit-finance risk; leading coverage: “Trump artık böyle para kazanacak : Kararı herkesi şaşırttı” (sozcu.com.tr); “Rising stablecoin outflows raise investor protection , FX concerns” (koreatimes.co.kr); “So viel Verlust hätte eine Investition in Sui von vor 1 Jahr eingebracht” (finanzen.net).
  • TRM recorded 207 hacks and approximately $972 million stolen in H1 2026.
  • North Korea-linked activity represented roughly 66% of stolen value, while infrastructure compromise drove 76% of losses.
  • Summer Finance reportedly lost about $6 million in a July 6 flash-loan exploit.
  • OFAC's ISIS-K designation update added 134 crypto wallet identifiers, illustrating continued terrorist-finance use of public chains.

Watch triggers

  • Another infrastructure or signing-system compromise above $50 million
  • Movement or laundering of large North Korea-linked balances
  • Stablecoin issuer freezes or exchange interdictions tied to designated wallets
  • Cross-chain bridge incidents or governance-control compromise
S19: TRM LabsS20: Crowdfund Insider citing PeckShieldS21: ChainalysisL20260802-193b55057b20: sozcu.com.trL20260802-ad4fbe5b9864: koreatimes.co.kr
#8
public health / domestic resilience

U.S. measles outbreak continues to expand across jurisdictions

Measles remains a high-confidence, steadily worsening resilience issue rather than a broad short-term market shock. The outbreak is geographically distributed and overwhelmingly associated with active clusters, which means local vaccination coverage and outbreak control remain the governing variables. The increase since early June is material but less nonlinear than the Ebola trajectory. Its operational consequences concentrate in public-health staffing, schools, pediatric care and community trust. The ranking is lower because cross-border and market transmission are more limited, not because the health burden is trivial. [Live-source refresh 2026-08-02] No current source stream produced a corroborating item for this threat. The score is therefore held near the prior run rather than being mechanically increased from stale evidence.

Score
76.55
Delta
0.00
Region
United States

Observed evidence

  • CDC reports 2,231 confirmed cases, including 13 among international visitors.
  • Thirty-two outbreaks have been reported in 2026.
  • Ninety-three percent of confirmed cases are outbreak-associated.
  • The count is 201 cases above the 2,030 reported in the June 4 baseline update.

Watch triggers

  • Additional large outbreaks in low-coverage communities
  • Hospital capacity or pediatric complication signals
  • Acceleration in imported cases
  • Material change in vaccination uptake or emergency public-health measures
S18: U.S. Centers for Disease Control and Prevention
Method

How the matrix is scored

RFDELTA scores each threat on severity, immediacy, cross-border transmission, momentum, confidence and operating impact. The matrix is designed for prioritization: what deserves leadership attention, monitoring time and operational preparation first.