Review – 3 Advisories Published – 8-6-26

Today CISA’s NCCIC-ICS published two control system security advisories for products from Johnson Controls and ABB; and one medical device security advisory for products from Medixant. 

Advisories  

Johnson Controls Advisory - This advisory describes a use of broken or risky cryptographic algorithm in the Johnson Controls (Tyco/DSC) TL280 internet security alarm communicator.  

ABB Advisory - This advisory discusses 13 vulnerabilities in the ABB Ability Zenon operations data management tool. 

Medixant Advisory - This advisory describes an out-of-bounds write vulnerability in the Medixant RadiAnt DICOM viewer. 

For more information on these advisories, including DTRH looks at researcher reports and an ABB exploit, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/3-advisories-published-8-6-26 - subscription required. 

Review - HR 9338 Introduced – Pipeline Safety Authorization

 Back in June, Rep Weber (R,TX) introduced HR 9338, the Pipeline Safety Authorization Act of 2026. While the Pipeline Safety Regulations (PSR) do not require reauthorization to continue in force, Congress uses periodic authorization bills to update the various statutes that form the basis for those regulations. The bill does include authorization for the appropriation of funds from user fee accounts and the Oil Spill Liability Trust Fund. 

Other Pending Pipeline Safety Bills  

The following bills introduced this session in the House are potentially competing pipeline safety bills: 

• HR 6187, the Wojnovich Pipeline Safety Act of 2025; no action,  
• HR 5537, the Pipeline Accountability Act of 2025; no action, and 
• HR 5301, the PIPES Act of 2025; ordered reported favorably. 

Committee Action  

One July 20th, 2026, the House Energy and Commerce Committee held a business meeting where HR 9338 was considered. A hearing transcript is available here; the HR 9338 portion can be found on pages 86 thru 113. Substitute language was offered by Webber and approved by a vote of 41 to 8. 

That substitute language would add the following sections: 

• Section 10. Grant program to repair, rehabilitate, or replace natural gas distribution pipeline systems.  
• Section 11. Excavation damage prevention.  
• Section 13. Carbon dioxide.  
• Section 14. Biennial pipeline safety rulemaking backlog plan.  
• Section 15. Study and reports on Community Liaison Services. 

Moving Forward  

Webber is not a member of the House Transportation and Infrastructure Committee to which this bill was assigned for primary consideration. Ordinarily, this means that there would be little chance that the bill would be considered by that Committee. But, since the Energy and Commerce Committee has secondary consideration for both this bill and HR 5301, select provisions from the version of this bill passed by ECC might be added by the Rules Committee to a version of HR 5301 considered by the Full House. That would be done to gain support from the Chair of the ECC for HR 5301. 

For more information on the provisions of this bill, and the legislative conflict with HR 5301, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/hr-9338-introduced-pipeline-safety - subscription required. 

 

Review - PHMSA in the Federal Register – 8-4-26

Yesterday, DOT’s Pipeline and Hazardous Materials Safety Administration (PHMSA) published 16 final rules in the Federal Register, all dealing with hazardous materials safety regulations. Notices of proposed rulemakings for each of these 16 rulemakings were published on July 1st, 2025. 

The 16 final rules are:  

• Hazardous Materials: Reducing Burdens on Domestic Companies Using Battery-Powered Equipment in Trades  
• Hazardous Materials: Adoption of Department of Transportation Special Permit 21478  
• Hazardous Materials: Adoption of Department of Transportation Special Permit 14175  
• Hazardous Materials: Adoption of Department of Transportation Special Permit 21379  
• Hazardous Materials: Adoption of Department of Transportation Special Permit 21287  
• Hazardous Materials: Adoption of Department of Transportation Special Permits 12412 and 11646 Into the Hazardous Materials Regulations  
• Hazardous Materials: Removing Burdensome Rail Reporting Requirements  
• Hazardous Materials: Reduce Training Burdens for America's Farmers  
• Hazardous Materials: Reducing Recordkeeping Requirements for Domestic Carriers  
• Hazardous Materials: Modernizing Payments To and From America's Bank Account  
• Hazardous Materials: Improving Efficiencies for Special Permits and Approvals Renewals  
• Hazardous Materials: Reducing Burdens by Allowing Continued Use of Department of Transportation Special Permit Packagings  
• Hazardous Materials: Remove Redundant List of U.S. EPA CERCLA Hazardous Substances  
• Hazardous Materials: Reducing Undue Paperwork Burdens to Domestic Carriers  
• Hazardous Materials: Reducing Costs to Domestic Shippers and Carriers of Limited Quantities   
• Hazardous Materials: Reducing Burdens on Domestic Aerosol Shippers  

For more information on these rulemakings, including a PHMSA summary, as well as a commentary on gaming EO 14192, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/phmsa-in-the-federal-register-8-4 - subscription required. Free CFSN subscribers will receive a copy of that article tomorrow. 

OMB Approves ChemLock ICR – 8-4-26

Yesterday, the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had approved a new information collection request (ICR) from CISA for the “ChemLock Program”. The 60-day ICR notice was published on December 31st, 2024, and the 30-day ICR notice was published on June 2nd, 2026. This approved ICR now authorizes CISA to collect information in support of its voluntary chemical facility security program, ChemLock. 

The ICR reporting notice explains that:  

“CISA serves as Sector Risk Management Agency (SRMA) for the Chemical Sector. CISA has established ChemLock, which is [a] voluntary program for facilities that possess dangerous chemicals. The information will support CISA’s Office of Chemical Security in providing resources tailored to the specific facilities requesting services under the ChemLock program.”