Review – Bills Introduced – 3-11-26

Yesterday, with just the Senate in Washington, there were 23 bills introduced. None of those bills are expected to receive additional coverage in this blog.

Space Geek Legislation

I would like to mention one bill under my limited Space Geek coverage in this blog:

S 4044 A bill to require the Administrator of the National Aeronautics and Space Administration to designate national high-energy astrophysics hubs. Markey, Edward J. [Sen.-D-MA]

 

For more information on these bills, including legislative history for similar bills in the 118^th Congress, see my article at CFSN Detailed Analysis - - subscription required.

Short Takes – 3-10-26 – Space Geek Edition

China designates space sector an “emerging pillar industry,” sets deep space ambitions in new economic blueprint. SpaceNews.com article. Pull quote: “These are sectors expected to become foundational drivers of economic growth, likely meaning they will benefit from strong policy support, state financing and industrial development programs. The move suggests Beijing intends to expand the space sector beyond strategic state programs toward a larger industrial ecosystem encompassing launch services, satellites and downstream data applications.”

Asteroid 2024 YR4 will not impact the Moon. ESA.int article. Pull quote: “Despite the challenges, the observations were a success. By comparing 2024 YR4’s position relative to the background stars, the team was able to measure its orbit accurately enough to rule out a lunar impact in 2032.”

Unlocking AI in space: the case for greater industry and space agency collaboration. SpaceNews.com commentary. Pull quote: “The opportunity is vast. From Earth observation satellites that must process terabytes of sensor data in real-time to Mars rovers making split-second navigation decisions millions of miles from human oversight, AI promises to unlock unprecedented autonomous capabilities across the space domain. Realizing this vision demands more than sophisticated algorithms. It requires hardware engineered to withstand the universe’s most unforgiving environments, where a single component failure can jeopardize a billion-euro mission.”

Jared Isaacman on rebuilding, Artemis and what he’s learned during his first months as NASA administrator. SpaceNews.com article. Pull quote: “Probably one of the bigger surprises is that in certain areas within NASA, we have either lost or outsourced some of our core competencies. That was surprising. More or less 75% of our workforce is contractors. There’s a lot of things that we have some external dependencies on that I would not have expected. We’ve got to look at that. There has to be certain expertise relevant to our mission that we retain inside the organization.”

Third Kairos launch fails. SpaceNews.com article. Pull quote: “In a social media post, Space One, the company that operates Kairos, said it activated the rocket’s flight termination system after it “determined that mission success was difficult,” according to a machine translation. The company did not immediately disclose additional details about the problem that triggered the termination of the launch.”

On moonshots and Minneapolis. ScienceNews.org commentary. Pull quote: “Maybe both things can be true. Space exploration “can be this incredibly powerful thing that can bring us together,” Maher says. “It can also be this thing, like a mirror, that illustrates that we have a lot of divisions and problems. That’s the beauty of it, that it can do both things.””

Blue Origin’s surprise TeraWave constellation jolts LEO broadband race. SpaceNews.com article. ““TeraWave will not be competing with Amazon Leo,” Plucinsky said via email. “We identified an unmet need with customers who were seeking enterprise-grade internet access with higher speeds, symmetrical upload/download speeds, more redundancy, and rapid scalability for their networks.””

Senate committee advances NASA authorization bill that changes Artemis and extends ISS. SpaceNews.com article. Pull quote: “The [Senate Commerce, Science, and Tranportation] committee passed on a voice vote March 4 an amended version of S. 933, a NASA authorization act originally introduced nearly a year ago. The committee also approved nearly 20 additional amendments from various committee members with the same vote.”

Backlog List

• ESA weighing options to address exploration funding shortfall,

• New ultraviolet image of comet 3I/ATLAS could help reveal what it's made of,

• Space Development Agency Makes Awards to Build 72 Tracking Layer Satellites for Tranche 3,

• Russia is about to do the most Russia thing ever with its next space station,

• Blue Origin breaks the accessibility barrier by sending the first wheelchair user to space,

• Improved ‘Terminator’ sun model could change space weather forecasting,

• Desert Works Propulsion expands U.S. ion propulsion capability through domestic manufacturing partnership and test capacity growth,

• Record launches, reusable rockets and a rescue: China made big strides in space in 2025,

• The crash of the MIRA-I spaceplane is raising serious concerns in the space industry, and

• HyPrSpace looks for applications beyond launch for its hybrid propulsion technology.

Review – 3 Advisories and 3 Updates Published – 3-10-26

Today CISA’s NCCIC-ICS published three control system security advisories for products from Honeywell, Lantronix and Apeman. They also update three advisories for products from Mitsubishi Electric.

Advisories

Honeywell Advisory - This advisory describes a missing authentication for critical function vulnerability (with publicly available exploit) in the Honeywell IQ4x BMS Controller.

NOTE: I briefly discussed the Zero Science report on March 8^th, 2026.

Lantronix Advisory - This advisory describes eight vulnerabilities in the Lantronix EDS3000PS and EDS5000 terminals.

Apeman Advisory - This advisory describes three vulnerabilities (each with publicly available exploits) in the Apeman ID71 cameras.

Updates

Mitsubishi Update #1 - This update provides additional information on the Iconics Digital Solutions advisory that was originally published on December 3^rd, 2024, and most recently updated on January 8^th, 2026.

Mitsubishi Update #2 - This update provides additional information on the Iconics Digital Solutions advisory that was originally published on July 2^nd, 2024, and most recently updated on January 8^th, 2026.

Mitsubishi Update #3 - This update provides additional information on the HMI SCADA advisory that was originally published on January 20^th, 2022, and most recently updated on January 8^th, 2026.

 

For more information on these advisories, including links to researcher reports and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/3-advisories-and-3-updates-published-ba4 - subscription required.

Review – Bills Introduced – 3-9-26

Yesterday, with the Senate in Washington and the House meeting in pro forma session, there were 44 bills introduced. One of those bills may receive additional coverage in this blog:

HR 7885 To direct the Secretary of Education to establish a pilot program to award competitive grants for the integration of cybersecurity education, and for other purposes. Thompson, Glenn [Rep.-R-PA-15]

 

For more information on these bills, including legislative history for similar bills in the 118^th Congress, as well as a mention in passing of a bill that would deregulate non-pasteurized milk, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/bills-introduced-3-9-26 - subscription required.

Review – HR 7384 Introduced – HF Prohibition

Last month Rep Waters (D,CA) introduced HR 7384, the Preventing Mass Casualties from Release of Hydrofluoric Acid at Refineries Act of 2026. The bill would prohibit the use of hydrogen fluoride (HF) in oil refineries. No new funding is provided by the bill.

This bill is similar to HR 10441, the Preventing Mass Casualties from Release of Hydrofluoric Acid at Refineries Act of 2024, that was introduced by Waters in December 2024. No action was taken in the House on that bill.

Moving Forward

While Waters is not a member of the House Energy and Commerce Committee to which this bill was assigned for consideration, one of her six cosponsors, Rep Barragán (D,CA), is a member. This could mean that there would be sufficient influence to see the bill considered in Committee. Unfortunately, this bill is very partisan and would be expected to be vehemently opposed by many Republicans. There is effectively no chance that this bill will be considered in the 119^th Congress.

 

For more information on the provisions of this bill, including a commentary on a possible alternative legislative solution to the problem, see my article at CFSN  Detailed Analysis - https://patrickcoyle.substack.com/p/hr-7384-introduced-hf-prohibition - subscription required.

Review – HR 7272 Introduced – DOE Pipeline Security

Back in January Rep Webber (R,TX) introduced HR 7272, the Pipeline Cybersecurity Preparedness Act. The bill would establish Department of Energy responsibilities for physical security and cybersecurity coordination to ensure the security, resiliency, and survivability of natural gas, hazardous liquid pipelines, and liquefied natural gas facilities. No new funding is provided.

Moving Forward

On February 4^th, 2026, the House Energy and Commerce Committee held a business meeting that included consideration of HR 7272. The bill passed, without amendments by a voice vote (pages 41-2). Pending publication of the committee report on the bill, the bill is ready for consideration by the full House. I suspect that it will be considered under the suspension of the rules process and would be expected to pass with strong bipartisan support.

Commentary

The inclusion of ‘hazardous liquid pipelines’ in the provisions of this bill is a tad bit odd as they would be a PHMSA area of expertise. While it is clear that general security requirements for energy pipelines would apply to non-energy related chemical pipelines, there are specific safety requirements that would be applicable to toxic chemical pipelines (downwind chemical detection comes to mind) that are probably not necessary for energy pipelines. Having said that, all of the voluntary security measures that would be developed under this bill’s provisions would be beneficial for hazardous liquid pipelines.

 

For more information on the provisions of this bill, including additional commentary on codifying DOE security research requirements, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/hr-7272-introduced-doe-pipeline-security - subscription required.

Review – Public ICS Disclosures – Week of 2-28-26 – Part 2

For Part 2 we have five additional vendor updates from FortiGuard (2), GE Vernova, HPE, and VMware. There are 12 researcher reports about vulnerabilities in products from Biosig Project (3), Honeywell, and Philips (8). Finally, we have six exploits for products from Honeywell, Splunk, WatchGuard, and Wireshark (3).

Updates

FortiGuard Update #1 - FortiGuard published an update for their OpenSSL advisory that was originally published on January 30^th, 2026, and most recently updated on February25th, 2026.

FortiGuard Update #2 - FortiGuard published an update for their SSL-VPN bookmarks advisory that was originally published on October 14^th, 2025.

GE Vernova Update - GE published an update for their Universal Relay advisory that was originally published on December 14^th, 2025.

HPE Update - HPE published an update for their Aruba Networking EdgeConnect SD-WAN Orchestrator advisory that was originally published on January 14^th, 2026, and most recently updated on February 10^th, 2026.

VMware Update - Broadcom published an update for the VMware Aria Operations advisory that was originally published on February 24^th, 2026.

Researcher Reports

Biosig Reports - Cisco Talos published three reports about vulnerabilities in the Biosig Project libbiosig library.

Honeywell Report - Zero Science published a report that describes an improper authentication for critical function vulnerability (with publicly available exploit) in the Honeywell Trend IQ4 building controller.

Philips Reports - ZDI published eight reports of vulnerabilities in the Philips Hue Bridge product that were disclosed in a recent Pwn2Own contest.

Exploits

Honeywell Exploit - Indoushka published a Metasploit module for an improper authentication for critical function vulnerability in the Honeywell Trend IQ4 product.

Splunk Exploit - Indoushka published an exploit for a function call with incorrectly specified argument value vulnerability in the Splunk Enterprise product.

WatchGuard Exploit - WatchTowr published an exploit for an out-of-bounds write vulnerability in the WatchGuard Fireware OS product.

Wireshark Exploit #1 - Indoushka published an exploit for an allocation of resources without limit or throttling vulnerabilities in the Wireshark USB HID Protocol Dissector.

Wireshark Exploit #2 - Indoushka published an exploit for a buffer overread vulnerability in the Wireshark Dissector product.

Wireshark Exploit #3 - Indoushka published an exploit for a NULL pointer dereference vulnerability in the Wireshark Dissector product.

 

For more information on these disclosures, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-2-bb7 - subscription required.