Review – Public ICS Disclosures – Week of 10-24-26

Today, over on CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-10-e62 - I published a list of 32 vendor disclosures from Belden, Fuji Electric, GE Vernova, Hitachi (5), Johnson Controls, Moxa (2), Palo Alto Networks, Siemens, VMware, and WatchGuard (18). There is one vendor update from Siemens. There are also seven Researcher Reports from AWESEC. Finally, we have 11 exploits for vulnerabilities in products from Axis (3), Mikrotik, Moxa (3), SonicWall (2), ST Engineering, and Zyxel. 

The article was sent to paid CFSN subscribers today by email. Free subscribers will automatically receive copies of those posts by email Wednesday. Subscribe today. 

Looking Back – 1-6-09 – STB Hazmat Accounting

Nearly every morning I start my computer time by looking at information from Google about what happened in my blog in the previous 24 hours. Google, and blogspot.com is a Google service, provides interesting pieces of analytical data about my blog readership. One item of particular interest is the top ten blog posts each day. As you would expect, most of those posts were from the last couple of days, but with 16 years of publishing this blog, every once-in-a-while, a blog post from ancient history rises into that list. 

Today a blog post from January 2009, “Railroad Accounting for Hazmat Shipment Costs ANPRM”, made the list. It looked at an advanced notice of proposed rulemaking (ANPRM) from the Surface Transportation Board that asked for public comment on perhaps changing the STB’s Uniform Railroad Costing System (URCS) reporting to separately list the costs associated with railroad transportation of hazardous materials. 

An interesting problem with these blog posts is that there is no forward linking to posts about the ultimate results for the actions being reported, especially when the agency's action is to cancel the action. In this case, in September 2016, the STB published a notice discontinuing the proceedings. That document summarized comments the Board received in response to the ANPRM, including an interesting point raised by ‘the railroads’: 

“The railroads argue that, even if the Board were to change URCS, they should also be allowed to present the unique costs of transporting hazardous materials in rate proceedings involving hazardous materials.” 

This particular can of worms may have contributed to the Board’s action to shut down the proceedings. 

Review - PHP Fallout in Control Systems - 10-31-26

Yesterday I published a free article over on CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/php-fallout-in-control-systems-10 - that updated my previous list of PHP2Shell advisories that had been published by control-system related vendors. I noted that: 

“We are continuing to see control system related vendors publishing new advisories and updated advisories for the two PHW2Shell vulnerabilities. Here is a non-exhaustive listing of both.” 

Short Takes – 10-30-26 - Space Geek Edition

Pentagon backs Stoke Space launch expansion with $150 million loan commitment. SpaceNews.com article. Pull quote: “Unlike SpaceX’s Starship, which relies on thousands of thermal protection tiles, Stoke is developing a metallic heat shield cooled by liquid hydrogen circulating through internal channels. The system is integrated with an upper-stage engine featuring 24 thrust chambers.” 

Cowboy Space unveils launch vehicle for deploying its orbital data center constellation. SpaceNews.com article. Very ambitious development plan. Pull quote: “Bhatt outlined in the presentation a concept called Trailhead that would combine a factory with a launch site. Each Trailhead would cost about $1 billion to develop and include five launch pads capable of launching 660 megawatts of computing capacity per year, a rate of nearly two launches per day.” 

This company’s plans to deploy space mirrors could jeopardize the night sky for many. TechnologyReview.com article. Pull quote: “That means Reflect Orbital will need permission on a national and local level to reflect sunlight onto the ground, but if the beams spread as much as Kocifaj and his team predict, “the company could need approvals in more than one jurisdiction,” says Hanlon. “There may also be aviation-safety and cross-border questions.”” 

SR-1 on track for late 2028 launch. SpaceNews.com article. Pull quote: “The agency has said little else about development of the mission. In June, Lori Glaze, associate administrator for NASA’s Human Spaceflight Mission Directorate, said NASA was working to “streamline the processes” for managing the mission to enable a launch in late 2028. Any delay would push the mission back to the next Mars launch opportunity at the end of 2030.” 

Satellogic and HEO extend non-Earth imaging contract. SpaceNews.com article. Pull quote: “The new agreement is largely an extension of previous agreements, he said, with no new technical capabilities. “We’ll continue to invest in higher agility, better ways to capture this imagery and improving RPO maneuvers,” he said. Satellogic has not modified its imaging satellites to support NEI applications but has updated software for operating the satellites.” 

Landspace tops bid to launch China’s Haolong reusable cargo spaceplane. SpaceNews.com article. Pull quote: “The notice does not describe the payload. However, the 611 Institute, best known for designing fighter aircraft including the J-20, has only one publicly known spacecraft project, the 10-meter-long, 7,000-kilogram Haolong reusable spaceplane for cargo. China National Radio previously reported that Haolong was planned to launch on Landspace’s Zhuque-3, and the tender now appears to formalize that arrangement.” 

Chemical Transportation Incidents – Week of 9-26-26

Reporting Background 

See this post for explanation, with the most recent update here (removed from paywall). 

Data from PHMSA’s online database of transportation related chemical incidents that have been reported to the agency. 

Incidents Summary  

• Number of incidents – 479 (456 highway, 18 air, 5 rail, 0 water) 
• Serious incidents – 0 (0 Bulk release, 0 evacuation, 0 injury, 0 death, 0 major artery closed, 0 fire/explosion, 20 no release)  
• Largest container involved – 30,140-gal DOT 117J100W Railcar {Alcohols, N.O.S.} Bottom overflow valve not completely closed and cap not tool tight. 
• Largest amount spilled – 55-gal Steel Drum {Pine Oil} Drum impacted by pallet during loading. 
• Total amount reported spilled in all incidents – 1154.3-gal 

NOTE: Links above are to Form 5800.1 for the incident described. 

Most Interesting Chemical: Pine Oil: A clear colorless to light amber colored liquid. Contains mainly tertiary and secondary terpene alcohols Produced from the wood of pine trees by extraction or steam distillation. Less dense than water and insoluble in water. Hence floats on water. Vapors are heavier than air. Vapors can cause headache, confusion, respiratory distress. Liquid irritates skin. (Source: CameoChemicals.NOAA.gov).  

INSERT UN 1272 Placard