Summary, 28 September 2026 · Eastern flank

The written assessment: today's news first, then key developments, where sources disagree and the outlook for the next 30 days.

Produced 28 September 2026, 20:46 UTC

Watchcon

Yellow · Significant concern

Moderate confidence · Trend: Rising

The call stands at the Yellow level because confirmed sabotage in Poland and repeated drone incursions into Romanian, Moldovan and Baltic airspace keep activity above the standing campaign tempo, while the effects stay unattributed and below an armed attack and no sector's conventional reading has moved.

Bottom line up front

Watch condition held at the Yellow level; attack on allies highly unlikely. Pressure rose over the eleven days on record: the board lifted Poland's sabotage reading and the Baltic, Black Sea and Moldovan probe readings after a confirmed sabotage act.
Sabotage inside supporting states almost certainly continues at the high rung. Poland recorded six sabotage events on four days from 18 to 28 September, one of them high, and the board raised the sabotage instrument twice in the period.
Air probes highly likely recur across four flank sectors. Probes ran in the Baltic states, Poland, the Black Sea and Moldova, nine events on six days in Poland alone, and three sectors' probe readings were raised.
Messaging against allied cohesion likely holds at its raised level. The board raised its Article 5 cognitive attack indicator to the high rung on 26 September, after a Russian state agency published, then deleted, a nuclear-strike threat against Lithuania.

Key developments

Poland's interior minister said the fire at the Starlink ground station in Wola Krobowska was sabotage, with those responsible still unidentified. For the board this is the confirmed act that sets Poland's hybrid reading at the high rung. polskieradio.pl
A Russian drone crossed into Romanian airspace near Ceatalchioi during an overnight attack on Ukraine, prompting F-16 scrambles and alerts in Tulcea. It is a further incursion in the sector whose probe reading the board raised on 28 September. digi24.ro
Romania's presidential administration said preliminary assessments indicate Russia hijacked a maritime drone that later exploded in Constanța Port months ago. If borne out it is an attack effect reaching flank port infrastructure, but it rests on one ungraded report of an earlier incident. g4media.ro
Polish aviation and ground air defences went to high readiness during Russian strikes on western Ukraine, an emergency alert covered Lublin Voivodeship and the Lublin and Rzeszów airports suspended operations. Spillover onto Polish civil life continues without an airspace violation. rmf24.pl
Poland will let pilots and commanders engage objects entering from the direction of Russia on radar and trajectory rather than visual identification. The threshold for a shootdown over allied territory drops, which the board watches for the first engagement under it. polskieradio.pl
Lithuania's defence ministry reported NATO Baltic Air Policing jets scrambled several times between 21 and 27 September to intercept Russian fighters, reconnaissance aircraft and bombers flying without flight plans and with transponders off. It is official confirmation of the Baltic probe tempo. kam.lt
Finnish and Swedish quick-reaction jets flew their first joint scramble to identify Russian military aircraft over the Gulf of Finland. The High North sector's air activity continues at its standing baseline, now met by combined allied response. x.com
Allies suspect Russia of probing undersea cables off Svalbard and staging military-style events in the Arctic, with Norway expanding northern naval and surveillance capacity. The board's untraceable cable disable indicator still sits at its lowest rung, so this is a watch item rather than a move. politico.eu

Where sources disagree

A low-graded aggregator report says NATO notes Russia acting more cautiously over drone border crossings near the Baltics and Poland, while graded reporting the same day records a fresh drone crossing into Romanian airspace and repeated Baltic intercepts.
Thresholds differ on Polish airspace: Operational Command says no violation was recorded, while the civil alert, the shelter warning and the suspension of the Lublin and Rzeszów airports treated the same strikes as a direct risk to Polish territory.
Expert commentary expects cross-border drone attacks near the Romanian border to become the norm and to worsen into winter, which no official assessment in the listed reports states.

Outlook

Likely another Russian drone crosses into Romanian airspace at a new site. Watch for scrambles beyond Solca, Ceatalchioi and Chilia Veche: debris landing on Romanian soil would push the Black Sea sector's hybrid reading higher.
Roughly even chance Poland engages an object under its new rules. Poland has replaced visual identification with radar-based rules: a first shootdown over Polish territory would bear directly on the board's deniable strike scenario.
Likely a confirmed sabotage case surfaces in another flank state. Finnish intelligence names its defence industry as exposed: a confirmed act beyond Poland would lift the High North or Baltic hybrid reading a step.
Unlikely a subsea cable off Svalbard is damaged within 30 days. The board's untraceable cable disable indicator sits at its lowest rung: a cable fault off Svalbard would be the first sign and would raise the High North reading.

Collection gaps

None filed in this summary.

In short

Poland's interior minister said last week's Starlink ground-station fire was sabotage, naming Wola Krobowska and noting that similar incidents are often linked to Russian intelligence, with the perpetrators still unidentified. polskieradio.pl
A Russian drone crossed into Romanian airspace near Ceatalchioi overnight, during a large attack on Ukraine, prompting F-16 scrambles and emergency air alerts for residents in Tulcea who watched strikes across the border at Izmail. digi24.ro
Polish aircraft and air defences went to high readiness during Russian strikes on western Ukraine, with an emergency alert across Lublin Voivodeship and the suspension of flights at Lublin and Rzeszów airports. The alert was later lifted and no Polish airspace violation was recorded. rmf24.pl
Poland will let pilots fire on incoming objects on radar alone, replacing mandatory visual identification with positive identification from radar and trajectory, which the deputy defence minister described as a response to repeated violations from the direction of Russia. polskieradio.pl

Analysis

Poland carries the day. The interior minister's confirmation that the Starlink ground-station fire at Wola Krobowska was sabotage turns a suspected arson into an established act against communications infrastructure on allied soil, and it is why the board's sabotage reading for Poland now sits at the high rung. A Lublin court sentencing a Belarusian man to three and a half years for filming a customs warehouse in Chełm, recruited over Telegram, shows the low-cost recruitment behind that pattern. Neither case names a state as the author, and that gap is the reason the day's activity stays below the threshold of an armed attack.

The High North stays quiet in acts and loud in warnings. Finnish and Swedish jets flew a first joint scramble over the Gulf of Finland to identify Russian aircraft, Finland's intelligence service said the Russian sabotage threat across Europe grew over the summer, and reporting describes allied suspicion of Russian probing of the subsea cables off Svalbard. No damage to cable or infrastructure is reported, so the sector's readings hold where they are.