OMB Approves NHTSA FMVSS 108 ADS Update NPRM

Tuesday, the OMB’s Office of Information and Regulatory Affairs, OIRA announced that it had approved a notice of proposed rulemaking (NPRM) from DOT’s National Highway Transportation Safety Administration (NHTSA) on “Modernization of FMVSS 108 to Accommodate ADS”. The NPRM was submitted to OIRA on September 17th, 2026. 

According to the 2026 Unified Agenda entry for this rulemaking: 

“The Federal Motor Vehicle Safety Standard that regulates vehicle lighting (FMVSS 108) includes requirements that assume a human driver and manual controls, references the location of a human driver, or specifies the operation of manual controls to effectuate testing for compliance with the standards. This rulemaking would address the applicability of the standard for vehicles that are equipped with automated driving systems (ADS) and lack manual controls. This rulemaking would maintain the level of safety performance required by the standard.” 

Since this ADS rulemaking does not appear to directly address cybersecurity issues, I do not expect that I will cover the provisions of this NPRM in this blog. I would expect, however, to announce its publication in the appropriate Short Takes post. 

Review – 5 Advisories and 1 Updated Published – 10-20-26

Today, CISA’s NCCIC-ICS published five control system security advisories for products from Hitachi Energy (2), Moxa, WAGO, HMS. They also published an update for products from Hitachi Energy. 

Advisories  

Hitachi Energy Advisory #1 - This advisory discusses nine vulnerabilities in the Hitachi Energy RTU500 series CMU Firmware. These are third-party vulnerabilities; six have publicly available exploits. 

Hitachi Energy Advisory #2 - This advisory describes three vulnerabilities in the Hitachi Energy MicroSCADA X SYS600 product. The vulnerabilities were reported to CISA by Zachary Andrew Wagner, Steven Nicolais, and Timotius Oetnung of the Sandia National Laboratories (CyTRICS program). 

Moxa Advisory - This advisory describes two vulnerabilities in the Moxa AIG-302 ThingsPro Edge. The vulnerabilities were reported to CISA by Ievgen Bondarenko. 

WAGO Advisory - The link for this advisory does not currently work. 

HMS Advisory - This advisory describes six vulnerabilities in the HMS Networks PEAK-System PCAN Windows drivers. The vulnerabilities were reported to CISA by Seyeon Bang. 

Updates 

Hitachi Energy Update - This update provides additional information on the RTU500 Product advisory that was originally published on March 3rd, 2026. The new information includes updating the fixed version for v12.7.8 and v13.8.2. 

For more information on these advisories, including a DTRH look at publicly available exploits and missing Siemens advisories, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/5-advisories-and-1-updated-published - subscription required. 

Review - S 5360 Introduced – Utility Cybersecurity Grants

Back in August, Sen McCormick (R,PA) introduced S 5360, the Rural and Municipal Utility Cybersecurity Act. The bill would rewrite 42 USC 18723, the Rural and municipal utility advanced cybersecurity grant and technical assistance program, to update and reauthorize that program. The existing $250 million annual authorization for the program would be extended through 2030. 

This bill is practically the same at HR 7266, that was introduced in January 2026 by Rep Miller-Meeks (R,IA), the bill was marked up by the Subcommittee on Energy of the House Energy and Commerce Committee in February; a minor amendment was adopted by a voice vote and the bill was favorably recommended to the full Committee by a voice vote. The bill was taken up by the full Committee on March 5th, 2026, and passed by a vote of 49 to 0. The full House considered HR 7266 on June 29th, under the suspension of the rules process. The bill was passed by a voice vote. No action has been taken on the bill in the Senate. 

Moving Forward  

While the Senate is free to consider both bills, it is unlikely to take up either under regular order as it is just too time consuming, and the bills are just not politically important enough, especially considering the limited time available after next month’s elections are over. Given the broad bipartisan support that HR 7266 saw in the House and the support S 5360 saw in Committee, either of these bills could possibly be successfully passed using the Senate’s unanimous consent process. 

For more information on the provisions of this bill, including the differences between it and HR 7266, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/s-5360-introduced-utility-cybersecurity - subscription required. 

CSB Complains About Polymer Company’s Failure to Act on Recommendations

Yesterday, the CSB released a commentary on the failure of Yenkin-Majestic/OPC Polymers to implement -- or even substantively respond to – any of the five safety recommendations issued by the CSB stemming from the agency’s investigation of the fatal April 2021 explosion and fire at the company’s Columbus, Ohio resin plant. 

The incident occurred in March of 2021 and resulted in one fatality, and eight personnel transported to local hospitals for treatment as well as over $90 million in damages. The CSB published their report on the incident in December 2023. That report listed seven recommendations made by the Board to help prevent future occurrences of this type of incident. Four of those recommendations were assigned to Yenkin-Majestic. In September of last year, the CSB updated the status of each of those recommendations to ‘Open – Unacceptable Response/No Response Received’. 

Part of the reason for the lack of response may have been the pending criminal charges that had been filed against the company for violating the negligent endangerment provision of the Clean Air Act for an explosion that killed one employee and injured many more (42 U.S.C. § 7413(c)(4)). The company may have felt that responding to the CSB’s recommendations would have been used as an admission of guilt in those proceedings. According to the DOJ, the company pleaded guilty to that charge on September 1st, 2026. 

On August 18th, 2026, the Yenkin-majestic Paint Corporation, was dissolved. Operations of OPC Polymers were transferred to a new, stand-alone entity, OPC Polymers LLC, operating in partnership with Multiquimica Dominicana. One would like to think that responsibility for implementing the recommendations would now fall upon that LLC.