Review – 3 Advisories and 2 Updates Published – 10-29-26

Today CISA’s NCCIC-ICS published three control system security advisories for products from Siemens and Hitachi Energy (2). They also updated two advisories for products from Hitachi Energy. 

Advisories  

Hitachi Energy Advisory #1 - This advisory describes two vulnerabilities in the Hitachi Energy CoreTec product. One is a third-party (Linux) vulnerability with publicly available exploit. The vulnerabilities were self-reported.  

Hitachi Energy Advisory #2 - This advisory describes two vulnerabilities in the Hitachi Energy TRO600 series products. The vulnerabilities were self-reported. 

Siemens Advisory - This advisory describes an authentication bypass by capture-replay vulnerability in the Siemens Mendix SAML Module. The vulnerability is self-reported. 

Updates  

Hitachi Energy Update #1 - This update provides additional information on the MSM Product advisory that was originally published on September 30th, 2026. The new information includes updating the remediation recommendation. 

Hitachi Energy Update #2 - This update provides additional information on the PCM600 advisory that was originally published on May 5th, 2026. The new information includes releasing remediation for PCM600 v3.1 SP4. 

For more information on these advisories, as well as DTRH looks at PHP2Shell advisories and public exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/3-advisories-and-2-updates-published-197 - subscription required. NOTE: With the PHP2Shell updates included, free subscribers to CFSN will receive their copy by email on Saturday. 

Review - S 5461 Introduced - Strategic Fertilizer Reserve

Last month, Sen Schumer (D,NY) introduced S 5461, the Strategic Fertilizer Reserve Act of 2026. The bill requires the USDA to undertake a study to evaluate the need for a strategic fertilizer reserve. It would then allow the USDA to establish such a reserve. The bill would authorize “such sums as are necessary” to establish and run the reserve. 

Since the disruption of shipping through the Strait of Hormuz began earlier this year, shipments of key fertilizers and fertilizer precursors have been reduced. This has had effects on fertilizer costs and availability, which has had an impact on the cost of food. Schumer’s bill would examine potential attempts to ameliorate similar future fertilizer shortages by establishing a fertilizer stockpile. 

Moving Forward  

While Schumer is not a member of the Senate Agriculture, Nutrition, and Forestry Committee to which this bill was assigned for consideration, his sole cosponsor, Sen Klobuchar (D,MN), is the Ranking Member of that Committee. This means, were their adequate time left in the session, there could be sufficient influence to see the bill considered by the Committee. I suspect that the biggest source of opposition to this bill would be the symbolically blank check that it would provide to USDA to study and establish the reserve. Even so, I expect that there would be some level of bipartisan support for the bill, especially from farm state Senators. 

For more information on the provisions of this bill, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/s-5461-introduced-strategic-fertilizer - subscription required. 

Short Takes – 10-29-26 - Federal Register Edition

Aviation Safety 

Notice of Order Designating U.S. Aviation Safety Team (USAST) Information as Protected From Disclosure. FAA notice of order. Summary: “This action affirms the order and responds to comments received in response to the Notice published on August 1, 2025, regarding designating U.S Aviation Safety Team (USAST) information as protected from disclosure. The Notice proposed that safety and security information as described below be designated by an FAA Order as protected from disclosure in accordance with the provisions of the rule entitled Protection of Voluntarily Submitted Information. The designation is intended to encourage persons to voluntarily provide information to the FAA through the USAST, supporting a collaborative, data-driven strategy to reduce the risk of fatal and non-fatal aviation incidents and accidents.” 

Information Collection Requests  

Agency Information Collection Activities; Submission to the Office of Management and Budget for Review and Approval; Comment Request; Chemical Data Reporting Under the Toxic Substances Control Act (TSCA) (Renewal). EPA 30-day ICR renewal notice. Summary: “This information collection request (ICR) addresses the paperwork requirements contained in the current Chemical Data Reporting (CDR) rule (40 CFR part 711) under the Toxic Substances Control Act (TSCA). Under TSCA section 8(a) (15 U.S.C. 2607), the Environmental Protection Agency (EPA) is authorized to collect certain information on chemical substances manufactured (including imported) or processed in the United States. The CDR was formerly known as the Inventory Update Rule (IUR).” 

Executive Orders  

EO 14438 - Decreasing Housing Costs for the American People. 

Short Takes – 10-28-26 - Chemical Incidents Edition

Bakery manufacturing facility evacuated after chemical spill in Dallas. WFAA.com article. Pull quote: “Approximately 25-30 employees were evacuated prior to DFR arrival, officials say. Due to the large parking lot around the facility, none of the nearby small businesses in the area were evacuated, fire crews say.” 

No risk of ammonia contamination, officials say, after fire at Oregon seafood plant prompted evacuations. NBCNews.com article. Near Miss. Pull quote: “Between all the firefighters and our regional hazmat team, they did an excellent job of protecting those tanks and keeping them, you know, from something worse happening,” Murphy said. “I can tell you that the tanks are intact; they’re not leaking. The product inside them is stable and will remain so.” 

Explosion and Fire at Quaker Oats Mill. MillingAndGrain.com article. Pull quote: “Most of the fire had been extinguished by 6:25 pm, though firefighters were still working inside the building on overhaul and final efforts. According to the fire department, the cause of the Quaker Oats fire and explosion is under investigation.” 

Homeland Security study to analyze 2025 Weatherford ammonia leak response. News9.com article. Pull quote: “On Tuesday, the Department of Homeland Security will host a conference in Oklahoma City to revisit the incident. DHS officials say Tuesday’s conference will look into the initial response, evacuations, air monitoring and communication between agencies.” 

CISA Withdraws OBP ICR Reinstatement Request

Yesterday, the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that CISA had withdrawn the new information collection request (ICR) for “Office for Bombing Prevention Technical Analysis”. The 60-day ICR notice was published on July 18th, 2025. The subsequent 30-day ICR notice was published on June 1st, 2026. No reason has been given for the withdrawal of this ICR. 

According to OIRA, the ICR would have supported OBP’s use of the following information collections: 

Pending resubmission of this ICR and the subsequent OIRA approval, as required by the Paperwork Reduction Act, OBP cannot legally require the use of any of those information collections. But, then again, the latest OIRA approval of those ICs ran out in August 2023. Since OBP is not a regulatory agency, I suppose that these ICs are voluntary. It does, however, raise an interesting question. Since OBP requires these forms to be submitted to receive support from the agency, are they truly voluntary? Any lawyers want to weigh in on this?