Review – 5 Advisories and 1 Update Published – 11-12-26

Yesterday, CISA’s NCCIC-ICS published five control system security advisories for products from Siemens. They also updated an advisory for products from Hitachi Energy. 

NOTE: Siemens published their monthly tranche of advisories and updates this week. None of them were covered by CISA yesterday. I will go into them in my weekly Public ICS Disclosures post this weekend. 

Advisories  

Siemens Advisory #1 - This advisory describes two use after free vulnerabilities in the Siemens RUGGEDCOM APE1808 product. These are third-party (PHP) vulnerabilities listed in CISA’s KEV catalog. 

Siemens Advisory #2 - This advisory describes an out-of-bounds write vulnerability in Siemens RUGGEDCOM APE1808 product. These are third-party (NodeJS) vulnerabilities listed in CISA’s KEV catalog. 

Siemens Advisory #3 - This advisory describes an out-of-bounds write vulnerability in Siemens Industrial Edge Management products. These are third-party (NodeJS) vulnerabilities listed in CISA’s KEV catalog. 

Siemens Advisory #4  

This advisory describes an out-of-bounds write vulnerability in Siemens Desigo, and Gridscale products. These are third-party (NodeJS) vulnerabilities listed in CISA’s KEV catalog. 

Siemens Advisory #5  

This advisory describes two use after free vulnerabilities in the Siemens Building Automation and Energy products. These are third-party (PHP) vulnerabilities listed in CISA’s KEV catalog. 

Updates 

Hitachi Energy Update  

This update provides additional information on the RTU500 advisory that was originally published on June 4th, 2026. The new information includes updating fixed version 12.7.8. 

For more information on these advisories, as well as a listing of publicly available exploits for the covered vulnerabilities, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/5-advisories-and-1-update-published-d81 - subscription required. 

Review - S 5291 Introduced - Small Business Cybersecurity Assistance Report

Back in August, Sen Schiff (D,CA) introduced S 5291, the Small Business Cybersecurity Assistance Evaluation Act of 2026. The bill would require the GAO to conduct a study of current Federal cybersecurity initiatives, programs, resources, tools, and services intended to assist owners of small business concerns. No new funding is authorized by this legislation. 

This bill is essentially the same as the reported version of HR 8880, that was introduced by Rep Simon (D,CA) in May of this year. On May 20th, 2026, the House Small Business Committee held a business meeting where nine bills were considered, including HR 8880. By a vote of 23 to 0, the Committee adopted the bill as introduced. On June 3rd, 2026, the Committee Report on the bill was published. HR 8880 is currently scheduled to be considered by the House today under the suspension of the rules process. Strong, bipartisan support for the bill is expected. On June 23rd, the bill was taken up by the full House under the suspension of the rules process and was passed by a voice vote. No action has yet been taken in the Senate on HR 8880. 

Moving Forward 

Both Schiff and his sole cosponsor, Sen Young (R,IN), are members of the Senate Committee on Small Business and Entrepreneurship. This means that there may be sufficient influence to see the bill considered by the Committee. Since this is a ‘report to Congress’ bill, I do not see anything in this bill that would engender any organized opposition. I suspect that S 5291 would receive some level of bipartisan support were it to be considered. This bill is not politically important enough to be considered by the full Senate under regular order, especially this late in the session. This bill would probably, however, be a good candidate for consideration under the Senate’s unanimous consent process. 

For more information on the provisions of this bill, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/s-5291-introduced-small-business - subscription required. 

Review – Bills Introduced – 11-11-26

Yesterday, with both the House and Senate in session, there were 24 bills introduced. One of those bills may receive additional coverage in this blog:  

S 5716 A bill to amend the Homeland Security Act of 2002 and titles 10 and 32, United States Code, to authorize the National Guard to protect certain facilities and assets from unmanned aircraft, and for other purposes. Lee, Mike [Sen.-R-UT]    

For more information on these bills, including legislative history for similar bills in the 118th Congress, and a mention in passing of three veterans recognition resolutions in the Senate, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/bills-introduced-11-11-26 - subscription required. 

Short Takes – 11-12-26 - Chemical Incidents

Fire crews respond to Greenville chemical plant explosion. WJTV.com article. Pull quote: “According to the City of Greenville, a chemical explosion occurred at Loveland Products, formerly Platte Chemical, around 7:10 a.m. on November 4, 2026. Preliminary information indicated that the incident involved a fire associated with a herbicide chemical in a hot box.” 

Shelter-in-place order lifted Friday night following hazardous material incident at Allentown water treatment facility. WFMZ.com article. Pull quote: “LCA Director of Communications Taylor Stakes said sodium hypochlorite was apparently delivered into the wrong tank, where it mixed with polyaluminum chloride." PJC – Produced chlorine gas and water vapor. 

Chemical leak at POM Wonderful plant in Del Rey sends 11 to hospital, state report shows what leaked. ABC30.com article. Pull quote: “"We did have 58 total patients. 11 were transported. Unknown on the outcome of those patients," said Fresno County Fire Capt. Casey Hutchings.” 

Solar Cell Manufacturer Restarts after Chemical Leaks. ISSSource.com article. Pull quote: “The restart follows a third-party safety and engineering review by TRC Engineers, which evaluated facility procedures, added double-wall piping for liquid chemical transfers, updated environmental health and safety policies, and fixed issues like missing gas monitors.” 

Mixing Bleach and Vinegar Is Poisoning More People Than Ever, 16-Year Study Finds. Bioengineer.org article. Pull quote: “The problem is that vinegar’s reputation as a benign kitchen staple makes it seem categorically different from a hazardous chemical, when in fact its acetic acid content makes it a highly efficient chlorine gas generator on contact with hypochlorite. The very perception that vinegar is safe may make people less cautious about combining it with bleach than they would be with a product bearing a corrosive warning label. The study’s authors note that this pattern is consistent with the growing use of vinegar alongside bleach as a perceived natural cleaning product, and the timing of the 2018 breakpoint aligns neatly with the mainstreaming of this cleaning philosophy.” 

Hydrochloric acid leak prompts hazmat response in Whitestown. WRTV.com article. Pull quote: “Just after 10 p.m., employees discovered heavy fumes coming from a trailer as they prepared to unload it. They closed the loading dock doors, moved the trailer away from the building, and called emergency services.” 

Hazmat team identifies chemical that made workers sick at Lenoir recycling facility. WSOCTV.com article. Pull quote: “Eric Bradford, director of operations at Asheville GreenWorks, said workers rely on the public to sort and dispose of items properly. Once materials reach a recycling facility, workers may handle and sort them by hand, creating the potential for packages to break open or leak.”