A Millisecond Bug Disrupted 2,000 UK Flights. The First Alert Came Two and a Half Hours Earlier.

On 8 September 2026, a valid request for a squawk code inside the UK's National Airspace System (NAS) collided with a higher-priority message during a window NATS estimates at roughly one millisecond. The request did not resume correctly, and the output was corrupted. NATS calls it a "legacy and previously unknown software defect." By the end of the day, more than 2,000 flights had been delayed, cancelled or diverted.

The defect is the headline. The more useful lesson for anyone running critical systems sits two and a half hours earlier, in a 45-second link drop that fixed itself and was logged as a system that had "recovered and is stable."

What the preliminary report says happened

NATS published its preliminary investigation report on 16 September. At 10:00, a squawk code request was made correctly against a valid flight plan. Unknown at the time, the latent defect and a timing coincidence corrupted flight data in the NAS. At 10:02, controllers and engineers saw an alert that the link between the London Area Control (LAC) system and the NAS had dropped. The alert cleared after 45 seconds. NATS later found the LAC system had dropped the link because processing the corrupted data took too long, and a timeout let it reconnect and carry on.

At 10:06, a standard engineering incident was raised. It noted that "although the failure has been detected, the system has recovered and is stable with no ongoing operational impact." Health checks found no hardware fault, and specialist teams began looking at whether a specific piece of flight data was involved. NATS is explicit that from 10:00 to 12:32 "all activity described below is routine engineering service management," and that there were no indications of the underlying corruption during that period.

At 12:32, the link began dropping repeatedly. At 13:32 it dropped and did not recover, and controllers moved to practised fallback procedures, coordinating handovers manually. Restrictions first applied at 12:45 were progressively tightened; departures from UK airports were stopped for around four and a half hours over a six-hour period. The NAS was restarted, data was reconciled by 18:50, and all airspace restrictions were lifted at 19:30.

Forecast (August 2026)

~8,000

Actually handled

6,094

NATS says it handled some 1,800 fewer flights than forecast, and that this does not reflect the full scale of disruption.

A self-healing anomaly is not a return to known-good

Nothing here suggests anyone acted carelessly. The 10:02 event was logged, checked and referred for deeper analysis, and the fallback procedures that controllers had rehearsed in their 2025/2026 refresher training were followed and kept operations safe. Every aircraft stayed safely separated.

But the operational posture after 10:06 was "recovered and stable," and the system kept serving live traffic while nobody yet knew why it had failed. That is the gap worth naming. A timeout that clears is evidence that a recovery mechanism fired. It is not evidence that the system is back in a verified, known-good state. The timeout that let the link recover at 10:02 was the same design that, at 13:32, dropped the link to protect both systems. NATS appears to agree: its short-term mitigations add an engineering framework for any link-drop event between LAC and the NAS, with defined reporting so suspected link failures are identified and escalated.

"Recovered" describes what the alert did. "Known-good" describes what the data is. They are not the same claim.

The fix is the next change to validate

NATS says the supplier has already developed and delivered a permanent fix. The report states it is "currently under test," with mitigations in place, and that "in line with established change processes the permanent fix will be deployed as soon as the testing is complete." That is the right order. It is also a reminder that the remedy for a defect in a live, interconnected system is itself a change to that system, and it deserves the same scrutiny as any other.

The final Major Incident Investigation report is due within 60 days of the incident. Its terms of reference include reviewing "defect records, system health monitoring, change activity, reliability trends, and asset lifecycle management." NATS also says the incident is not related to the 2023 FPRSA failure or last year's radar issue, and the UK Transport Secretary has ordered an independent review into the cause and the resilience of the country's air traffic control infrastructure.

A one-millisecond window is not something any test plan would reasonably find in advance. The two and a half hours that followed are a different matter. The earliest signal is often the quietest, and the discipline is in refusing to call it healthy until you can prove it.