The US Government Accountability Office (GAO) issued a report on September 21, 2026, warning that aircraft communications systems are vulnerable to interception and cyber spoofing. According to the watchdog, malicious actors could exploit these security gaps in systems like ACARS and CPDLC to transmit fraudulent air traffic control messages, potentially disrupting flights or creating safety hazards.
Additionally, the GAO found that the Federal Aviation Administration (FAA) lacks real-time capabilities to monitor and detect electromagnetic spectrum threats. The US Department of Transportation, responding on behalf of the FAA, concurred with all nine recommendations in the report to address security and coordination.
Separately, on the same day the report was published, an ATC communications outage disrupted flights across the New York area and at Philadelphia International Airport (PHL) due to a ground circuit failure, which officials confirmed was not related to a cyberattack.
