Summary, 6 November 2026 · Eastern flank

The written assessment: today's news first, then key developments, where sources disagree and the outlook for the next 30 days.

Produced 6 November 2026, 18:12 UTC

Watchcon

Yellow · Significant concern

Moderate confidence · Trend: Rising

The Yellow level holds because hybrid acts grew across the fortnight: Poland's sabotage cases, Black Sea and Baltic drone probes and cyberattacks all rose. None is an armed attack on allied territory, and the conventional reading stays at level 1.

Key developments

Romania scrambled two F-16s on 6 Nov after radar found an aerial target east of Sulina heading toward Ukraine, and sent an RO-ALERT to northern Tulcea county: the Black Sea probe pattern is still reaching Romania's border. radioconstanta.ro
A Russian Gerbera-2 drone washed ashore near Shabla on Bulgaria's coast and was destroyed on site after the defence ministry confirmed it; its origin and time of impact are unknown, so it adds a find on allied soil but no attribution. x.com
Moldova's defence ministry logged 69 airspace violations in 2026, a drone over Camenca and Vărăncău on 4 Nov and drone fragments at Gordinești on 5 Nov: drone spillover into Moldova continues. moldpres.md
Cyberattacks that heated refrigeration in food stores hit stores in Finland, Estonia, Sweden and other states this week, and the Kremlin denies involvement: the cyber pattern against civilian systems is now Europe-wide. is.fi
Two pro-Russian groups claimed cyberattacks on refrigerators in Romania and said power plants and water networks are next: a claim only, but it names the targets the board would watch. t.me
Bomb threats disrupted at least 15 flights on Thursday, three linked to Poland, with diversions to Sofia and Plovdiv; authorities have not named those responsible, so the board holds this as an unattributed disruption. polskieradio.pl
Lithuania's defence minister said its Kaliningrad border is calmer than Poland's and that troops aiding border guards since 8 Oct will likely stay past mid-November: allied border precaution persists on both sides. lrt.lt
Polish police, border guards and GROM troops have been deployed to the Kaliningrad border since 2 Nov, while Russian outlets suggest Warsaw plans a provocation: a narrative that matches the board's lawfare and information watch. defence24.com

Where sources disagree

Bomb-threat emails: one report says they were traced to a Russian far-right group and Colombia, the group's founder denies any link, and Polish reporting says authorities have not identified those responsible.
Refrigeration cyberattacks: the Kremlin calls the blame on Russia 'nonsense', while two pro-Russian groups claimed the Romanian attacks and threatened more.
Kaliningrad border: Poland says it thwarted a possible provocation, Lithuania calls its side calmer, and Russian outlets cast Poland as the one preparing a provocation.

Outlook

Further drone alerts and debris are highly likely in Romania and Moldova. Watch for another RO-ALERT in Tulcea or fresh debris finds; a drone confirmed inside Romanian airspace would raise the Black Sea probe reading.
More arrests and sabotage cases in Poland are likely. Watch for new arrests or arson in Poland; a further act tied to Russian services would keep the Poland sector's hybrid reading rising.
Further cyberattacks on utilities or cold-chain systems across Europe are likely. Pro-Russian groups claimed Romanian refrigerator attacks and named power plants and water networks next; a confirmed hit on either would raise the cyber reading.
Another drone incursion into Latvia or Lithuania is likely. Watch for a new Latvian air threat alert or interceptor launch; a repeat would hold the Baltic probe reading at its raised level.

Collection gaps

None filed in this summary.

In short

Romania scrambled F-16s over a target near Sulina. Radar found an aerial target east of Sulina heading toward Ukraine on 6 Nov. Two F-16s took off from Borcea and an RO-ALERT went to northern Tulcea county. radioconstanta.ro
A Russian Gerbera-2 drone washed up in Bulgaria. It was found on a beach near Shabla and destroyed on site after the defence ministry confirmed it. Its origin and time of impact are unknown. x.com
Moldova counts 69 airspace violations this year. A drone flew over Camenca and Vărăncău on 4 Nov, and drone fragments with no explosive were found near Gordinești on 5 Nov. moldpres.md
Bomb threats disrupted flights across Europe. At least 15 flights were hit on Thursday, three linked to Poland, with diversions to Sofia and Plovdiv. Authorities have not named those responsible. polskieradio.pl

Analysis

Black Sea: Romania raised two air alerts for Tulcea county on 6 Nov. The first, at 00:19, came as Russia hit Ukraine's Danube ports, and no incursion into Romanian airspace was reported. The second followed a target near Sulina heading toward Ukraine. The Gerbera-2 on the Bulgarian coast is a separate find with no known flight path.

Cyber and hoaxes: the Kremlin denies involvement in the refrigeration cyberattacks, and two pro-Russian groups claimed attacks in Romania and named power plants and water networks next. The bomb-threat emails have been tied by one report to a Russian far-right group, which denies it. No authority has attributed them.

Moldova: the drone over Camenca and the fragments near Gordinești show spillover continuing. The fragments carried no explosive payload.