CSB Releases ‘RIPE for Change’ Video

On Thursday, the Chemical Safety Board (CSB) released their latest safety video, “RIPE for Change”. The video supports the 2024 CSB safety study “Remote Isolation of Process Equipment”. The video shows three incidents where there were prolonged fires because the facility could not close piping that continued to allow flammable liquids to spill into the incident area. 

That safety study resulted in three CSB recommendations: 

• API - 2024-01-H-1 - Closed - Acceptable Action,  
• EPA - 2024-01-H-2 - Open - Awaiting Response or Evaluation/Approval of Response, and 
• OSHA - 2024-01-H-3 - Open - Awaiting Response or Evaluation/Approval of Response. 

OMB Approved BIS Spacecraft EAR IFR – 11-13-26

Yesterday, the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had approved an interim final rule (IFR) from the DOC’s Bureau of Industry and Security (BIS) on “Export Administration Regulations: Combined Space Reform (CSR)”. This IFR was sent to OIRA on June 15th, 2026. BIS published an earlier IFR on this topic on October 23rd, 2024. 

According to the 2026 Unified Agenda entry for this rulemaking: 

“In this interim final rule (IFR), the Bureau of Industry and Security (BIS) implements and/or finalizes recent changes to controls for spacecraft and related items under the Export Administration Regulations (EAR) included in the October 23, 2024 interim final rule (IFR), Export Administration Regulations: Revisions to Space-Related Export Controls,” and the October 23, 2024 proposed rule [link added], Export Administration Regulations: Revisions to Space-Related Export Controls, Including Addition of License Exception Commercial Space Activities (CSA).  This IFR also addresses the public comments received in response to both rules.  This IFR reduces license requirements on less sensitive items to reflect the close relations with certain allied countries to better facilitate space collaboration and makes refinements and clarifications to existing space-related export controls. These changes will better enable a globally competitive U.S. space industrial base while continuing to protect U.S. national security and foreign policy interests.” 

The publication of this IFR will be announced in the appropriate Short Takes post as part of my limited Space Geek coverage. 

Review – Bills Introduced – 11-12-26

Yesterday, with both the House and Senate finishing their first week back in Washington, there were 31 bills introduced. One of those bills will receive additional coverage in this blog:  

HR 11032 To establish a grant program carried out by the Department of Homeland Security to fund university-based cybersecurity clinics at junior or community colleges, historically Black colleges and universities (HBCUs), Hispanic-serving institutions (HSIs), and other minority-serving institutions, and for other purposes. Veasey, Marc A. [Rep.-D-TX-33]    

For more information on these bills, including legislative history for similar bills in the 118th Congress, as well as a mention in passing of a bill to codify the ICE CDL Tipline, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/bills-introduced-11-12-26 - subscription required. 

Review – 5 Advisories and 1 Update Published – 11-12-26

Yesterday, CISA’s NCCIC-ICS published five control system security advisories for products from Siemens. They also updated an advisory for products from Hitachi Energy. 

NOTE: Siemens published their monthly tranche of advisories and updates this week. None of them were covered by CISA yesterday. I will go into them in my weekly Public ICS Disclosures post this weekend. 

Advisories  

Siemens Advisory #1 - This advisory describes two use after free vulnerabilities in the Siemens RUGGEDCOM APE1808 product. These are third-party (PHP) vulnerabilities listed in CISA’s KEV catalog. 

Siemens Advisory #2 - This advisory describes an out-of-bounds write vulnerability in Siemens RUGGEDCOM APE1808 product. These are third-party (NodeJS) vulnerabilities listed in CISA’s KEV catalog. 

Siemens Advisory #3 - This advisory describes an out-of-bounds write vulnerability in Siemens Industrial Edge Management products. These are third-party (NodeJS) vulnerabilities listed in CISA’s KEV catalog. 

Siemens Advisory #4  

This advisory describes an out-of-bounds write vulnerability in Siemens Desigo, and Gridscale products. These are third-party (NodeJS) vulnerabilities listed in CISA’s KEV catalog. 

Siemens Advisory #5  

This advisory describes two use after free vulnerabilities in the Siemens Building Automation and Energy products. These are third-party (PHP) vulnerabilities listed in CISA’s KEV catalog. 

Updates 

Hitachi Energy Update  

This update provides additional information on the RTU500 advisory that was originally published on June 4th, 2026. The new information includes updating fixed version 12.7.8. 

For more information on these advisories, as well as a listing of publicly available exploits for the covered vulnerabilities, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/5-advisories-and-1-update-published-d81 - subscription required. 

Review - S 5291 Introduced - Small Business Cybersecurity Assistance Report

Back in August, Sen Schiff (D,CA) introduced S 5291, the Small Business Cybersecurity Assistance Evaluation Act of 2026. The bill would require the GAO to conduct a study of current Federal cybersecurity initiatives, programs, resources, tools, and services intended to assist owners of small business concerns. No new funding is authorized by this legislation. 

This bill is essentially the same as the reported version of HR 8880, that was introduced by Rep Simon (D,CA) in May of this year. On May 20th, 2026, the House Small Business Committee held a business meeting where nine bills were considered, including HR 8880. By a vote of 23 to 0, the Committee adopted the bill as introduced. On June 3rd, 2026, the Committee Report on the bill was published. HR 8880 is currently scheduled to be considered by the House today under the suspension of the rules process. Strong, bipartisan support for the bill is expected. On June 23rd, the bill was taken up by the full House under the suspension of the rules process and was passed by a voice vote. No action has yet been taken in the Senate on HR 8880. 

Moving Forward 

Both Schiff and his sole cosponsor, Sen Young (R,IN), are members of the Senate Committee on Small Business and Entrepreneurship. This means that there may be sufficient influence to see the bill considered by the Committee. Since this is a ‘report to Congress’ bill, I do not see anything in this bill that would engender any organized opposition. I suspect that S 5291 would receive some level of bipartisan support were it to be considered. This bill is not politically important enough to be considered by the full Senate under regular order, especially this late in the session. This bill would probably, however, be a good candidate for consideration under the Senate’s unanimous consent process. 

For more information on the provisions of this bill, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/s-5291-introduced-small-business - subscription required.