By exploiting the communication infrastructure among the sensor, actuator, and control system, attackers may compromise the security of unmanned aircraft cyber‐physical systems, with techniques such as denial‐of‐service (DoS) attack, random attack, and data‐injection attack. In this paper, the data‐injection attacks for controller and sensor are modeled as the dual unknown disturbance inputs (dual‐UIs) appearing in dynamic and measurement model. The problem of secure state estimation under multiple attacks together with the DoS attack‐induced packet dropout is transformed into the problem of stochastic system state estimation under dual‐UIs together with the missing measurement. Therefore, a recursive dual‐UIs decoupling filter is proposed through minimizing the minimum upper bound of the estimation covariance. First, a Kalman‐like recursive filter scheme independent of the dual‐UIs is established to realize the unbiased estimation. Meanwhile, a lower bounded adaptive factor is introduced to depict the state related unknown dual‐UI that cannot be eliminated completely due to the randomly missing measurements. Then, the minimum upper bound of the estimation covariance is deduced via online scalar convex optimization, based on which the measurement coefficient matrix is derived under the dual‐UIs decoupling conditions. Finally, the sufficient condition for the convergence of the proposed filter is shown and the stability of the state estimate is investigated. Simulation cases of unmanned aircraft longitudinal flight control system verifies the effectiveness and superiority of the proposed method.