Looking Back – 8-3-25 – Public ICS Disclosures

Nearly every morning I start my computer time by looking at information from Google about what happened in my blog in the previous 24 hours. Google, and blogspot.com is a Google service, provides interesting pieces of analytical data about my blog readership. One item of particular interest is the top ten blog posts each day. As you would expect, most of those posts were from the last couple of days, but with 16 years of publishing this blog, every once-in-a-while, a blog post from ancient history rises into that list. 

Today a blog post from August 2025 made the list; not as long ago as normal, but interesting nonetheless. There used to be a series of posts I did every weekend where I would post about new advisories from control system related vendors that had not been covered by CISA that week. They started as short posts, frequently only two or three advisories each week. But as my list of vendors and then researchers (as I added researcher reports on ICS vulnerabilities) continued to grow, so did the number of weekly advisories included in the post. That growth frequently required two or three posts per week.  

I stopped making these posts due to the amount of time it consumed every weekend. It was a lot of work, and too much time away from the family. With no reader feedback, either on the posts or their stoppage, I think that this was probably a good decision. 

But this last weekend, I used my list of vendor websites to compile the list of PHP2Shell advisories published, and I realized how many advisories I had missed since I stopped making these posts. So, I am reconsidering that decision. I do not think that I would be covering as many vendors and researchers, over 200 vendor websites on my current list. Still thinking about how I would select the vendors and researchers that would be covered by the weekly post. 

Short Takes – 10-24-26 - Federal Register Edition

Space Geek  

Space Modernization for the 21st Century. FCC futher notice of proposed rulemaking. Summary: “Today's commercial space industry is rapidly innovating, requiring a regulatory framework which provides speed, predictability, and flexibility. Therefore, in this Order, the Commission moves forward with modernizing our rules to build a space “licensing assembly line” and adopting a new part 100. Like a physical assembly line, our new processes will move licensing requests in standard and predictable ways and result in increased efficiency and a higher quality of Commission review. By reforming our licensing and operating rules, the Commission complements its other ongoing activities to boost the space economy.” 

Wireless Telecommunications Bureau Establishes a New Docket and the Process for Comment on Eligible Space Station Operator Transition Plans. FCC notice. 

FMVSS and ADS  

Federal Motor Vehicle Safety Standards; Modernization of FMVSS No. 108 To Accommodate ADS-Equipped Vehicles. NHTSA notice of proposed rulemaking. Summary: “NHTSA is proposing to amend Federal Motor Vehicle Safety Standard (FMVSS) No. 108, “Lamps, reflective devices, and associated equipment.” The proposed updates to the standard are intended to remove unnecessary requirements and to provide design flexibility without impact on vehicle safety. The first two proposed changes would amend the test voltage specification for integral beam type headlamps and remove requirements that apply to vertical headlamp arrangements. Further proposed changes address vehicles equipped with Automated Driving Systems (ADS) that do not have manually operated driving controls. Those modifications would limit the application of certain requirements for manually operated turn signal, hazard warning signal, and beam switching controls to vehicles with manually operated driving controls. The changes are intended to address regulatory burdens and costs associated with equipment that does not fulfill the same purpose or provide safety benefits in an ADS-equipped vehicle without manually operated driving controls as in a vehicle with such controls. The changes would also narrow certain requirements for telltales to vehicles with manually operated driving controls and incorporate the term “telltale” where appropriate throughout the standard. Finally, a proposed addition to the standard would allow cyan-colored ADS marker lamps as optional motor vehicle lighting equipment in ADS-equipped vehicles.” 

Review - PHP Fallout in Control Systems

When the news came out this week about the two 0-day vulnerabilities (CVE-2026-109618, CVE-2026-109619) from PHP, known as PHP2Shell, the first question that many people asked was: Do I use PHP? A lot of control system people assumed that they were unaffected, but just as we saw with Log4J in late 2021 and early 2022, the affected software shows up in a lot of unusual places. 

I have published a free post over on CFSN Detailed Analysis (https://patrickcoyle.substack.com/p/php-fallout-in-control-systems) of a list of control system related (broadly related) advisories about system impacts from PHP2Shell. Again, as with Log4J, some of these are nothing more than ‘we are not affected’ reports. This is not an exhaustive list, so check with your vendor if you do not see advisories here for your systems. 

Note: I am using the CFSN site rather than this blog because it is easier to read lists of advisories on that site than here. Again, that is a free post. 

OMB Approves FCC Mobile Earth Stations Final Rule

Yesterday, the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had approved a final rule from the FCC on “Amendment of Parts 2 and 25 of the FCC Rules to Facilitate the Use of Earth Stations in Motion Communicating with Geostationary Orbit Space Stations in FSS Bands: IB Docket No. 17-95”. The notice of proposed rulemaking was published on June 16th, 2017. A further notice of proposed rulemaking (FNPRM) was published on July 24th, 2020. 

According to the 2026 Unified Agenda entry for this rulemaking: 

“In June 2017, the Commission began a rulemaking to streamline, consolidate, and harmonize rules governing earth stations in motion (ESIMs) used to provide satellite-based services on ships, airplanes and vehicles communicating with geostationary-satellite orbit (GSO), fixed-satellite service (FSS) satellite systems. In September 2018, the Commission adopted rules governing communications of ESIMs with GSO satellites. These rules addressed communications in the conventional C-, Ku-, and Ka-bands, as well as portions of the extended Ku-band. At the same time, the Commission also released a Further Notice of Proposed Rulemaking that sought comment on allowing ESIMs to operate in all of the frequency bands in which earth stations at fixed locations operating in GSO FSS satellite networks can be blanket-licensed. Specifically, comment was sought on expanding the frequencies available for communications of ESIMs with GSO FSS satellites to include the following frequency bands: 10.7-10.95 GHz, 11.2-11.45 GHz, 17.8-18.3 GHz, 18.8-19.3 GHz, 19.3-19.4 GHz, 19.6-19.7 GHz (space-to-Earth); and 28.6-29.1 GHz (Earth-to-space).” 

I plan on announcing the publication of this final rule when it is published in the next week or two in the appropriate Short Takes post as part of my limited Space Geek coverage. 

Chemical Transportation Incidents – Week of 9-19-26

Reporting Background 

See this post for explanation, with the most recent update here (removed from paywall). 

Data from PHMSA’s online database of transportation related chemical incidents that have been reported to the agency. 

Incidents Summary  

• Number of incidents – 473 (453 highway, 16 air, 2 rail, 2 water) 
• Serious incidents – 2 (2 Bulk release, 0 evacuation, 0 injury, 0 death, 0 major artery closed, 3 fire/explosion, 16 no release)  
• Largest container involved – 23,850-gal DOT 111A100W1 Railcar {Cresylic Acid} Bottom overflow valve leaking. 
• Largest amount spilled – 55-gal Plastic Drum {Alkyl Sulfonic Acids, Liquid or Aryl Sulfonic Acids, Liquid with Not More Than 5 Percent Free Sulfuric Acid} Drum cracked during unloading. 
• Total amount reported spilled in all incidents – 3305.7-gal 

NOTE: Links above are to Form 5800.1 for the incident described. 

Most Interesting Chemical: 1,1,1-Trichloroethane: A colorless liquid with a sweet, pleasant odor. May irritate skin, eyes and mucous membranes. In high concentrations the vapors may have a narcotic effect. Nonflammable, but may decompose and emit toxic chloride fumes if exposed to high temperatures. Used as a solvent. (Source: CameoChemicals.NOAA.gov).  

INSERT UN 2831 Placard