Summary, 7 November 2026 · Eastern flank

The written assessment: today's news first, then key developments, where sources disagree and the outlook for the next 30 days.

Produced 7 November 2026, 19:58 UTC

Watchcon

Yellow · Significant concern

Moderate confidence · Trend: Rising

Sabotage in Poland, drone alerts near Romania and Moldova, and merchant ship strikes in the Black Sea recur, but no listed report ties them to a conventional attack on allied territory. The Yellow level holds.

Key developments

Human remains were found aboard the tanker Wine Trader in a Varna shipyard, 15 days after a drone strike off Romania on 15 Oct. A police source said the victims were very probably six. It shows the Black Sea merchant strikes have cost lives on allied shipping. digi24.ro
Two balloon-type objects crossed Moldova's airspace on 7 Nov over Drochia and Soroca districts. About 70 violations are logged since the start of 2026, so the airspace probing in Moldova keeps recurring. moldpres.md
Polish police have logged at least 10 cyberattacks on shop fridges and cold stores. The cold-storage attack wave now reaches Poland, a new target for the cyber instrument. rmf24.pl
Bulgaria is mobilising its navy, border police and civilian resources to protect Black Sea shipping after repeated drone attacks. Responsibility for the attacks is unconfirmed in this report, and the move shows the strikes are now driving a state response. x.com
Three Russian vessels with weapons reportedly left Kaliningrad, escorted by the corvette Stoikiy, and two looped in the southern Baltic while NATO vessels shadowed them. The report is single-sourced and the destination is unknown. x.com
Estonia's security service KAPO warned that nearly 400 Estonian students in Russia risk recruitment by Russian intelligence or dispatch to the front. It is an official warning of an intelligence threat, not an incident. news.err.ee

Where sources disagree

Wine Trader toll: Bulgarian National Radio reported five bodies and NOVA six, a police source said very probably six, and prosecutors have confirmed no official toll while DNA tests run.
Fridge and freezer attacks: pro-Russian groups claimed them, but analysts found most of the posted proof in older leaks and Danfoss sees no sign of a breach.

Outlook

Further drone alerts near Romania and Moldova are highly likely. Watch for new RO-ALERT notices in Tulcea and more Moldovan airspace violations; a drone strike causing damage in Romania would raise the Black Sea probe reading.
More sabotage or spying arrests in Poland are likely. Poland logged 5 sabotage events in the last 7 days against 1 before; further arrests or arson tied to Russian services would hold the Poland sabotage reading.
Cold-storage cyberattacks will likely reach more flank states. Watch for confirmed damage to hospitals, blood stocks or utilities in Poland or the Baltic states; that would keep the cyber instrument rising.
Another drone strike on a Black Sea merchant ship is likely. Watch for a new sinking or crew casualties off Bulgaria or Romania; a month without strikes would ease the Black Sea maritime reading.

Collection gaps

None filed in this summary.

In short

Human remains were found on a drone-struck tanker. Bulgarian prosecutors in Varna said very damaged remains were found aboard the Wine Trader, hit off Romania on 15 Oct. A police source said the victims were very probably six. DNA tests are ordered. digi24.ro
Polish police are hunting a second Krakow attacker. One report says a second attacker from a terrorist attack in Krakow is on the run. It names no sponsor and the reporting is thin. x.com
Two balloon-type objects crossed Moldova's airspace. Moldova's Defence Ministry said one crossed over Drochia district at 09:15 and another from Ukraine toward Soroca district at 10:35. Both left within minutes. moldpres.md
Polish police have logged at least 10 cyberattacks on fridges and cold stores. An expert warned that cooling systems holding blood, food and data-centre servers could be targeted next. rmf24.pl

Analysis

Black Sea: the Wine Trader finding turns a drone strike off Romania into a confirmed loss of life on a merchant ship, though the toll is not official. Bulgaria is now mobilising its navy and border police to protect shipping, and one report says responsibility for the attacks is still unconfirmed.

Poland: two separate reports reach Polish soil. Police are hunting a second attacker in Krakow, with no sponsor named, and police have logged at least 10 cyberattacks on cold storage. Neither report links the other, and the board treats the Krakow case as unattributed.

Moldova: the balloon crossings over Drochia and Soroca add to a long run of airspace violations, with about 70 recorded since the start of 2026. The Air Operations Centre is still monitoring.

Baltic Sea: a single report says three Russian vessels left Kaliningrad with weapons, escorted by the corvette Stoikiy, and that NATO vessels are shadowing them. The destination is unknown and no second source backs it.