Monthly editorial readings of the database: what concentrated, what changed and what remains uncertain. These notes interpret recorded incidents; they do not establish attribution beyond the sources cited in each record.
August 2026
First monthly report · 28 records
Reading. August shows a concentrated, airspace-led pattern. Most records concern the detection, recovery or neutralisation of platforms rather than completed disruption inside European territory.
Comparison. This is the baseline month for the series. September subsequently recorded a much larger and more varied mix, so August should be read as a concentrated drone-led phase rather than a normal monthly level.
August was dominated by the eastern flank and, above all, by drone-related events. Twenty-three of the 28 recorded incidents were classified as drone incidents. Romania alone accounted for 16 records, while Moldova accounted for four: together, the two countries represented 20 of the month’s entries.
The sequence was particularly dense along the Black Sea and the lower Danube. The database records recoveries of airframes and fragments, reported cross-border incursions, neutralisations, and incidents involving maritime drones. This geographical concentration is consistent with spillover from the war against Ukraine, but the database does not treat proximity or origin as proof of attribution in itself.
Dominant pattern: drone incursions, debris recoveries and air-defence responses.
Main locations: Romania and Moldova, with isolated entries in Latvia, Bulgaria and Poland.
Secondary pattern: three sabotage records and two disrupted or alleged plots, including cases connected to defence or political targets.
September 2026
Second report · database snapshot through 27 September · 69 records
Reading. September is not simply “more drones”. It is a broader month in the record, combining airspace pressure with alleged or investigated disruption against infrastructure and defence-related targets.
Comparison with August. Recorded volume rose from 28 to 69 entries (+146%). Drones remained the largest category, but their share fell as sabotage, airspace incidents, military encounters, plots and espionage entries became much more visible. The record therefore shifts from a geographically concentrated airspace pattern to a broader mixed-pressure pattern.
September broadened both the volume and the geography of recorded activity. The database contains 69 records through 27 September, compared with 28 during the whole of August. This should not be read as a precise measure of operational escalation, because reporting density and retrospective additions also affect the count.
Drone incidents remained the largest category with 33 records, but the month was markedly more diverse: 14 sabotage records, nine airspace incidents, three military encounters, seven plots and three espionage-related entries. Poland and Romania (15 records each), Moldova (9), Lithuania (7) and Germany (6) were the most represented locations. These five locations account for 52 of the 69 records.
Eastern flank: repeated drone and airspace incidents in Poland, Romania, Moldova and Lithuania remained the main recorded pattern.
Infrastructure and defence sector: fires, rail disruption and suspected sabotage cases extended the picture beyond airspace events, notably in Poland, Germany and Latvia.
Geographic spread: the database records incidents in 19 countries or areas, including Denmark, France, Latvia, the Netherlands, Luxembourg, Slovakia and the United Kingdom.
Monitoring priorities
Watch next
These are areas to monitor in the record, not forecasts and not evidence of responsibility for future events.
Eastern-border airspace
Follow repeat detections, recoveries and official updates around the lower Danube, Moldova, Poland and Lithuania; distinguish confirmed crossings from reports that remain unresolved.
Support and connectivity
Track alleged disruption affecting rail, border systems, communications and logistics connected to civilian resilience or support to Ukraine.
Official statements
Watch for public attribution, investigative findings and technical evidence. These can change a record’s status without changing the underlying event.