Summary, 6 November 2026 · Eastern flank

The written assessment: today's news first, then key developments, where sources disagree and the outlook for the next 30 days.

Produced 6 November 2026, 23:12 UTC

Watchcon

Yellow · Significant concern

Moderate confidence · Trend: Rising

Harm on allied soil stays below an armed attack: drone debris, arson, cable and cyber damage. Drone alerts in Romania and the Baltics and sabotage in Poland keep the flank at the Yellow level, with no sign of massing forces.

Key developments

A Russian Gerbera-2 drone was found on a beach near Shabla on Bulgaria's Black Sea coast and destroyed on site after Bulgaria's defence ministry confirmed what it was. Its origin, flight path and time of impact are unknown; for the board it is drone wreckage on allied soil. x.com
Romania sent a second RO-ALERT to northern Tulcea on 6 Nov and scrambled two F-16s after radar picked up an air target east of Sulina heading toward Vâlcove in Ukraine. It shows the Black Sea flank still drawing allied jets and public alerts. radioconstanta.ro
Lithuania's defence minister said its Kaliningrad border is calmer than Poland's, where Warsaw says it thwarted a possible provocation. Lithuanian troops have aided border guards since 8 Oct and an extension past mid-November is likely, so the border stays on a preventive footing. lrt.lt
A wave of bomb threats disrupted at least 15 flights across Europe on Thursday, three of them linked to Poland, with diversions to Sofia and other airports. Authorities had not named those responsible, so the wave is a disruption pattern without an attributed source. polskieradio.pl
A Helsinki court jailed the Fitburg's captain and bosun over the New Year's Eve 2025 anchor drag that cut Baltic cables. The verdicts are not final, but they set a legal precedent for cable cases in the High North and Baltic Sea sector. is.fi
Moldova's defence ministry reported 69 airspace violations since the start of 2026. A drone flew over Camenca in Transnistria and Vărăncău on 4 Nov, and drone fragments without explosives were found in Rezina district on 5 Nov, so drone spillover onto Moldova continues. moldpres.md
Satellite imagery shows three antenna rows, each over 500 metres long, at a radar complex near Gvardeisk in Kaliningrad, able to detect aircraft and missiles 3,000 km away. Its readiness is unconfirmed, and it is a capability in the exclave, not a force build-up. hs.fi

Where sources disagree

Bomb-threat wave: one headline says the emails were traced to a Russian far-right group and Colombia, while another report says authorities had not identified those responsible. The founder of the named Russian movement denies any link.
Bomb-threat counts differ: at least 15 flights in one report, nearly 30 in another, more than 30 in a third. A commentary puts the threats at 51 by 6 Nov.
Refrigeration cyberattacks: the Kremlin calls the blame on Russia baseless, while pro-Russian groups claimed attacks in Romania and threatened more.
Kaliningrad border: Poland says it thwarted a possible provocation, Lithuania calls its own stretch calmer, and Russian outlets suggest Warsaw is preparing a provocation.

Outlook

Further drone alerts or debris in Romania and Bulgaria are highly likely. Watch for repeat RO-ALERTs in Tulcea or more drone wreckage on the Black Sea coast; either would hold the Black Sea flank at its level 3 hybrid reading.
Another Russia-linked sabotage case in Poland is likely. Watch for new arrests or arson tied to Russian services in Poland; a case that harms people would lift Poland's hybrid reading above level 2.
Further cyberattacks on European utilities or food chains are likely. Watch whether pro-Russian groups hit a power plant or water network as they threatened; that would show the cyber pattern reaching a new target.
Another drone incursion into Baltic airspace is likely. Watch for new Latvian or Lithuanian airspace alerts with interceptor launches; a drone causing damage on the ground would lift the Baltic hybrid reading above level 3.

Collection gaps

None filed in this summary.

In short

A Russian drone washed ashore in Bulgaria. A Gerbera-2 was found on a beach near Shabla and destroyed on site after Bulgaria's defence ministry confirmed it. Its origin, flight path and time of impact are unknown. x.com
Romania scrambled F-16s over the Black Sea coast. Radar detected an air target east of Sulina heading toward Vâlcove in Ukraine. Two F-16s took off and a second RO-ALERT went to northern Tulcea residents. radioconstanta.ro
Bomb threats disrupted flights across Europe. At least 15 flights were hit on Thursday, three linked to Poland, with diversions to Sofia and other airports. Authorities had not named those responsible. polskieradio.pl
Lithuania keeps troops on its Kaliningrad border. Its defence minister called the border calmer than Poland's and said an extension past mid-November is likely. Troops have aided border guards since 8 Oct. lrt.lt

Analysis

Black Sea coast: Romania sent an alert to northern Tulcea shortly after midnight on 6 Nov as Russia struck Ukraine's Danube ports. It was lifted at 00:41 and no incursion into Romanian airspace was reported. Later that morning radar found an air target east of Sulina, two F-16s took off and a second alert went out. In Bulgaria, the drone on the Shabla beach shows wreckage can reach allied shores unseen.

Disruption across Europe: the bomb-threat wave reached flights and broadcasters, with emails to an Irish and a Bulgarian broadcaster signed 'Mikhail Andropov' warning that 'this is only the beginning'. One report says the emails were traced to a Russian far-right group and Colombia. The founder of the named Russian movement denies any link. Separately, two pro-Russian groups claimed refrigeration cyberattacks in Romania and named power plants and water networks as next.