Short Takes – 10-24-26 - Federal Register Edition

Space Geek  

Space Modernization for the 21st Century. FCC futher notice of proposed rulemaking. Summary: “Today's commercial space industry is rapidly innovating, requiring a regulatory framework which provides speed, predictability, and flexibility. Therefore, in this Order, the Commission moves forward with modernizing our rules to build a space “licensing assembly line” and adopting a new part 100. Like a physical assembly line, our new processes will move licensing requests in standard and predictable ways and result in increased efficiency and a higher quality of Commission review. By reforming our licensing and operating rules, the Commission complements its other ongoing activities to boost the space economy.” 

Wireless Telecommunications Bureau Establishes a New Docket and the Process for Comment on Eligible Space Station Operator Transition Plans. FCC notice. 

FMVSS and ADS  

Federal Motor Vehicle Safety Standards; Modernization of FMVSS No. 108 To Accommodate ADS-Equipped Vehicles. NHTSA notice of proposed rulemaking. Summary: “NHTSA is proposing to amend Federal Motor Vehicle Safety Standard (FMVSS) No. 108, “Lamps, reflective devices, and associated equipment.” The proposed updates to the standard are intended to remove unnecessary requirements and to provide design flexibility without impact on vehicle safety. The first two proposed changes would amend the test voltage specification for integral beam type headlamps and remove requirements that apply to vertical headlamp arrangements. Further proposed changes address vehicles equipped with Automated Driving Systems (ADS) that do not have manually operated driving controls. Those modifications would limit the application of certain requirements for manually operated turn signal, hazard warning signal, and beam switching controls to vehicles with manually operated driving controls. The changes are intended to address regulatory burdens and costs associated with equipment that does not fulfill the same purpose or provide safety benefits in an ADS-equipped vehicle without manually operated driving controls as in a vehicle with such controls. The changes would also narrow certain requirements for telltales to vehicles with manually operated driving controls and incorporate the term “telltale” where appropriate throughout the standard. Finally, a proposed addition to the standard would allow cyan-colored ADS marker lamps as optional motor vehicle lighting equipment in ADS-equipped vehicles.” 

Review - PHP Fallout in Control Systems

When the news came out this week about the two 0-day vulnerabilities (CVE-2026-109618, CVE-2026-109619) from PHP, known as PHP2Shell, the first question that many people asked was: Do I use PHP? A lot of control system people assumed that they were unaffected, but just as we saw with Log4J in late 2021 and early 2022, the affected software shows up in a lot of unusual places. 

I have published a free post over on CFSN Detailed Analysis (https://patrickcoyle.substack.com/p/php-fallout-in-control-systems) of a list of control system related (broadly related) advisories about system impacts from PHP2Shell. Again, as with Log4J, some of these are nothing more than ‘we are not affected’ reports. This is not an exhaustive list, so check with your vendor if you do not see advisories here for your systems. 

Note: I am using the CFSN site rather than this blog because it is easier to read lists of advisories on that site than here. Again, that is a free post. 

OMB Approves FCC Mobile Earth Stations Final Rule

Yesterday, the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had approved a final rule from the FCC on “Amendment of Parts 2 and 25 of the FCC Rules to Facilitate the Use of Earth Stations in Motion Communicating with Geostationary Orbit Space Stations in FSS Bands: IB Docket No. 17-95”. The notice of proposed rulemaking was published on June 16th, 2017. A further notice of proposed rulemaking (FNPRM) was published on July 24th, 2020. 

According to the 2026 Unified Agenda entry for this rulemaking: 

“In June 2017, the Commission began a rulemaking to streamline, consolidate, and harmonize rules governing earth stations in motion (ESIMs) used to provide satellite-based services on ships, airplanes and vehicles communicating with geostationary-satellite orbit (GSO), fixed-satellite service (FSS) satellite systems. In September 2018, the Commission adopted rules governing communications of ESIMs with GSO satellites. These rules addressed communications in the conventional C-, Ku-, and Ka-bands, as well as portions of the extended Ku-band. At the same time, the Commission also released a Further Notice of Proposed Rulemaking that sought comment on allowing ESIMs to operate in all of the frequency bands in which earth stations at fixed locations operating in GSO FSS satellite networks can be blanket-licensed. Specifically, comment was sought on expanding the frequencies available for communications of ESIMs with GSO FSS satellites to include the following frequency bands: 10.7-10.95 GHz, 11.2-11.45 GHz, 17.8-18.3 GHz, 18.8-19.3 GHz, 19.3-19.4 GHz, 19.6-19.7 GHz (space-to-Earth); and 28.6-29.1 GHz (Earth-to-space).” 

I plan on announcing the publication of this final rule when it is published in the next week or two in the appropriate Short Takes post as part of my limited Space Geek coverage. 

Chemical Transportation Incidents – Week of 9-19-26

Reporting Background 

See this post for explanation, with the most recent update here (removed from paywall). 

Data from PHMSA’s online database of transportation related chemical incidents that have been reported to the agency. 

Incidents Summary  

• Number of incidents – 473 (453 highway, 16 air, 2 rail, 2 water) 
• Serious incidents – 2 (2 Bulk release, 0 evacuation, 0 injury, 0 death, 0 major artery closed, 3 fire/explosion, 16 no release)  
• Largest container involved – 23,850-gal DOT 111A100W1 Railcar {Cresylic Acid} Bottom overflow valve leaking. 
• Largest amount spilled – 55-gal Plastic Drum {Alkyl Sulfonic Acids, Liquid or Aryl Sulfonic Acids, Liquid with Not More Than 5 Percent Free Sulfuric Acid} Drum cracked during unloading. 
• Total amount reported spilled in all incidents – 3305.7-gal 

NOTE: Links above are to Form 5800.1 for the incident described. 

Most Interesting Chemical: 1,1,1-Trichloroethane: A colorless liquid with a sweet, pleasant odor. May irritate skin, eyes and mucous membranes. In high concentrations the vapors may have a narcotic effect. Nonflammable, but may decompose and emit toxic chloride fumes if exposed to high temperatures. Used as a solvent. (Source: CameoChemicals.NOAA.gov).  

INSERT UN 2831 Placard 

Review – 19 Advisories and 1 Update Published – 10-22-26

Today CISA’s NCCIC-ICS published 18 control system security advisories for products from Siemens (17) and Kiloview. They also published a medical device security advisory for products from Kiloview. Finally, they updated an advisory for products from Meari IoT. 

Advisories  

RUGGEDCOM Advisory #1 - This advisory discusses four vulnerabilities in the Siemens RUGGEDCOM APE1808. These are third-party (Nozomi Networks) vulnerabilities. 

RUGGEDCOM Advisory #2 - This advisory describes six vulnerabilities in the Siemens RUGGEDCOM CROSSBOW Station Access Controller. These are third-party (SQLite) vulnerabilities; four with publicly available exploits. 

RUGGEDCOM Advisory #3 - This advisory describes 11 vulnerabilities in the Siemens RUGGEDCOM CROSSBOW. The vulnerabilities were self-reported. 

Industrial Edge Advisory #1 - This advisory describes two vulnerabilities in the Siemens Industrial Edge Cloud Device (IECD). The vulnerabilities were self-reported. 

Industrial Edge Advisory #2 - This advisory describes two vulnerabilities in the Siemens Industrial Edge Device Kit. The vulnerabilities were self-reported. 

Industrial Edge Advisory #3 - This advisory describes two vulnerabilities in the Siemens Industrial Edge App Publisher. According to the Siemens advisory, the vulnerabilities were reported by Ezinne Kalu. 

SIMATIC S7 Advisory #1 - This advisory discusses 377 vulnerabilities in the Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem. These are third-party (Linux) vulnerabilities. 

SIMATIC S7 Advisory #2 - This advisory describes eight vulnerabilities in the Siemens SIMATIC Drive Controller CPU 1504D TF. The vulnerabilities were self-reported. 

SIMATIC S7 Advisory #3 - This advisory discusses 428 vulnerabilities in the Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP. These are third-party (Linux) vulnerabilities. 

SIMATIC S7 Advisory #4 - This advisory describes two vulnerabilities in the Siemens .NET Client Library for SIMATIC S7 Webserver API. The vulnerabilities were self-reported. 

WinCC Advisory - This advisory describes an incorrect privilege assignment vulnerability in the Siemens SIMATIC WinCC V7.5. According to the Siemens advisory, the vulnerability was reported by Sascha Meyer, Simon Wessling, and Jonathan Lauener from GAI NetConsult GmbH. 

APOGEE Advisory - This advisory describes five vulnerabilities in the Siemens APOGEE, TALON and Desigo PXC/PXM products. According to the Siemens advisory, the vulnerabilities were reported by Stanislav Dashevskyi and Francesco La Spina from Forescout Technologies. 

SIMATIC IPCs Advisory - This advisory describes a use of default cryptographic key vulnerability in the Siemens SIMATIC IPC BX-21A. The vulnerability was self-reported. 

PSS(R)SINCAL Advisory - This advisory discusses an out-of-bounds write vulnerability in the Siemens PSS(R)SINCAL V21.5. This is a third-party (Wibu) vulnerability.  

SENTRON Advisory - This advisory discusses an improper verification of source of a communications channel vulnerability in the Siemens SENTRON 3NA COM Fuse. The vulnerability was self-reported. 

Capital Advisory - This advisory describes an out-of-bounds read vulnerability in the Siemens Capital Embedded AR Classic 431-422. According to the Siemens advisory, the vulnerabilities were reported by Stanislav Dashevskyi and Francesco La Spina from Forescout Technologies. 

Software Center Advisory - This advisory describes an uncontrolled search path element vulnerability in the Siemens Siemens Software Center. According to the Siemens Advisory, the vulnerability was reported by Jose Oregon from Huntress Labs. 

Kiloview Advisory - This advisory describes nine vulnerabilities in the Kiloview E3 NDI Encoder. The vulnerabilities were reported to CISA by Juan Alonso. 

InterSystems Advisory - This advisory describes a cleartext transmission of sensitive information vulnerability in the InterSystems Corporation InterSystems IRIS for Health data platform. The vulnerability was reported to CISA by Abhinav Agarwal. 

Meari Update - This update provides additional information on the Cloud Platform advisory that was originally reported on October 1st, 2026. The new information includes adding vendor remediations for both CVEs. The original advisory reported that “Meari did not respond to CISA’s coordination attempts.” 

For more information on these advisories, as well as DTRH looks at publicly available exploits, additional reporting, and KEV vulnerabilities, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/19-advisories-and-1-update-published-e1f - subscription required.