Chemical Incident Reporting – Week of 5-9-26

NOTE: See here for series background.

Tucson, AZ – 5-7-26 

Local News Report: Here, here, here, and here. 

There was a traffic accident that resulted in a 100-gal muriatic acid (pool chemical) spill. A shelter-in-place order was put into place for the immediate area, and the road was closed while the spill was cleaned up. No injuries were reported. 

Not CSB reportable, transportation related event. 

Hopewell, VA – 5-9-26  

Local News Report: Here and here. 

There were neighborhood complaints of an ammonia odor from a chemical plant. A shelter-in-place order was issued. A brief vapor release was confirmed at the facility. 

Not CSB reportable. 

Tulsa, OK – 5-11-26  

Local News Report: Here, here, and here. 

There was a large fire at an oil refinery. One worker was transported to local hospitals for smoke inhalation issues. Several vehicles were destroyed on site.  

Possible CSB reportable. 

Cleveland, TN – 5-14-26  

Local News Report: Here, here, here, and here. 

There was a lithium-ion battery explosion at a metals manufacturing facility that resulted in powdered titanium alloy exposure concerns. Two people were transported to local hospitals for burns from the explosion. 

Possible CSB reportable. 

Interesting point here. Lithium battery fires emit dangerous chemicals so such fires could count as a CSB reportable (40 CFR Part 1604) incident if the other requirements (fixed site, severe injuries, deaths, or damages) are met. For this incident, the titanium powder issue is just an added chemical hazard. 

Review – Bills Introduced – 5-15-26

Yesterday, with just the House in Washington, there were 35 bills introduced. One of those bills will receive additional coverage in this blog: 

HR 8845 Commerce, Justice, Science, and Related Agencies Appropriations Act, 2027. Rogers, Harold [Rep.-R-KY-5] 

Space Geek Legislation  

I would like to mention one bill under my limited Space Geek coverage in this blog: 

HR 8851 To amend title 51, United States Code, to direct the Secretary of Transportation to establish an electronic processing portal for licenses and other approvals related to commercial space launch activities, and for other purposes. Haridopolos, Mike [Rep.-R-FL-8] 

For more information on these bills, including legislative history for similar bills in the 118th Congress, as well as a mention in passing of a bill that would expand the definition of domestic terrorism, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/bills-introduced-5-15-26 - subscription required. 

Review – Public ICS Disclosures – Week of 5-9-26 – Part 1

This week is a moderately busy disclosure week. We have bulk vendor disclosures from FortiGuard (5), HP (6), HPE (6), and Palo Alto Networks (24). We have eleven additional vendor disclosures from Advantech, ELECOM, CODESYS, Philips, QNAP, Schneider (4), and Siemens (2). 

Advisories  

Bulk Vendor Disclosures – Forti Guard (5), 

Bulk Vendor Disclosures – HP (6), 

Bulk Vendor Disclosures – HPE (6), 

Bulk Vendor Disclosures – Palo Alto Networks (24) 

Advantech Advisory - Advantech published an advisory that describes an SQL injection vulnerability in multiple Advantech products. 

ELECOM Advisory - JP-CERT published an advisory that describes seven vulnerabilities in multiple ELECOM wireless LAN routers and access points. 

CODESYS Advisory - CODESYS published an advisory that describes a missing release of resource after effective lifetime vulnerability in their MODBUS-327 addon. 

Philips Advisory - Philips published an advisory that discusses the cPanel missing authentication for critical function vulnerability that was recently added to CISA’s Known Exploited Vulnerabilities catalog. 

QNAP Advisory - QNAP published an advisory that discusses the Dirty Frag vulnerabilities. 

Schneider Advisory #1 - Schneider published an advisory that describes a cleartext storage of sensitive information vulnerability in their EcoStruxure Machine Expert HVAC product. 

Schneider Advisory #2 - Schneider published an advisory that describes an insufficient entropy vulnerability in multiple Schneider products. 

Schneider Advisory #3 - Schneider published an advisory that describes path traversal vulnerability in the EasyLogic T150 and Saitel DP Remote Terminal Unit products. 

Schneider Advisory #4 - Schneider published an advisory that describes an insecure default initialization of resource vulnerability in their EcoStruxure Panel Server product. 

Siemens Advisory #1 - Siemens published an advisory that discusses an out-of-bounds write vulnerability in their RUGGEDCOM APE1808 Devices. 

Siemens Advisory #2 - Siemens published an advisory that describes two vulnerabilities in KACO Blueplanet Inverters. 

For more information on these disclosures, including links to 3rd party advisories, researcher reports, and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-5-2e4 - subscription required.