Short Takes – 9-22-26 - Federal Register Edition

HSAR – PPE  

Homeland Security Acquisition Regulation, Make Personal Protective Equipment in America Act Restrictions on Foreign Acquisition (HSAR Case 2024-003). DHS final rule. Summary: “DHS is issuing a final rule to amend the Homeland Security Acquisition Regulation (HSAR) codifying how DHS complies with the requirements of the Make Personal Protective Equipment (PPE) in America Act. These changes are intended to ensure the sustainment and expansion of domestic manufacturing for certain types of PPE critical to the United States' national response to a public health crisis.” 

Pipeline Safety  

Pipeline Safety: Meeting of the Liquid Pipeline Advisory Committee. PHMSA advisory committee meeting notice. Summary: “This notice announces a public meeting of the Technical Hazardous Liquid Pipeline Safety Standards Committee, also known as the Liquid Pipeline Advisory Committee (LPAC). The meeting will be held virtually to discuss the following notices of proposed rulemaking (NPRMs): “Breakout Tank Inspection,” “Remote Monitoring of Hazardous Liquid Pipeline Rectifiers,” and “Hazardous Liquid Valve Maintenance Schedule.”” 

Executive Orders  

EO 14428 - Providing Meaningful Water Quality Improvements Through Collaboration and Oversight of Federal Support. 

EO 14429 - Reinvigorating America's Hunting Heritage. 

EO 14430 - Restoring American Saltwater Angling and Recreation. 

Review – Bills Introduced – 9-21-26

Yesterday, with the House meeting (once again) in pro forma session, there were 27 bills introduced. One of those bills will probably receive additional coverage in this blog: 

HR 10519 To direct the Secretary of Homeland Security, acting through the Director of the Cybersecurity and Infrastructure Security Agency, to establish a Critical Infrastructure AI Cyber Defense Pilot Program, and for other purposes. Gottheimer, Josh [Rep.-D-NJ-5]    

For more information on these bills, including legislative history for similar bills in the 118th Congress, as well as a mention in passing of a bill that would direct the EPA to research tropospheric ozone, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/bills-introduced-9-21-26 - subscription required. 

CISA Adds Zyxel Vulnerability to KEV – Catalog – 9-21-26

Today, CISA announced that they had added a stack-based buffer overflow vulnerability in the Zyxel GS1900 series switches to their Known Exploitable Vulnerabilities (KEV) catalog. Zyxel reported the vulnerability on June 16th, 2026. The vulnerability was reported to Zyxel by Lei Gu, Jun Cao, Zhiqing Rui, Jingzheng Wu, and Tianyue Luo from Institute of Software, Chinese Academy of Sciences (ISCAS). 

Today, GreyNoise reported (in an article about a WordPress exploit): 

“In addition to the above findings, GreyNoise discovered the MCA [malicious cyber actor] targeted ZyXEL GS1900 Smart Managed Switches globally with a novel exploit of CVE-2026-7273. As of 17 September 2026, this is the first publicly documented case of exploitation in the wild of this vulnerability, which is also not on [obviously dated before today’s CISA announcement] the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) catalog at the time of publication. The MCA successfully exploited and exfiltrated sensitive data from 996 ZyXEL switches across 48 countries.” 

CISA has directed federal agencies using the affected Zyxel devices to apply “mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s “Forensics Triage Requirements” [Links added]. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable.” 

A compliance date of September 24th, 2026, has been established. 

Review - CSB Updated the Status of 5 Investigation Recommendations – 9-16-26

Earlier this week, the Chemical Safety Board (CSB) updated their Recent Recommendation Status Updates page, closing three recommendations with ‘acceptable action’, one with ‘acceptable alternative actions’, and one with ‘exceeds recommended action’. These actions left 129 of 1061 recommendations open. Additionally, the CSB updated the open status of three recommendations. The CSB took all of these actions on September 16th, 2026. The previous update was published on August 6th, 2026. 

Closed Recommendations  

The five recently closed recommendations are: 

• Bio-Lab Lake Charles Chemical Fire and Release - 2020-05-I-LA-3 - Bio-Lab Lake Charles,  
• Foundation Food Group Fatal Chemical Release - 2021-03-I-GA-2 - Messer LLC,  
• Foundation Food Group Fatal Chemical Release - 2021-03-I-GA-3 - Messer LLC, 
• Givaudan Sense Colour Explosion - 2024-06-I-KY-11 - International Molasses Corporation LTD, and 
• Givaudan Sense Colour Explosion - 2024-06-I-KY-12 - Corn Refiners Association. 

For more information on the investigation responses, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/csb-updated-the-status-of-5-investigation - subscription required. 

FCC Sends Mobile Ground Station Final Rule to OMB

Yesterday, the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had received a final rule from the FCC on “Amendment of Parts 2 and 25 of the FCC Rules to Facilitate the Use of Earth Stations in Motion Communicating with Geostationary Orbit Space Stations in FSS Bands: IB Docket No. 17-95”. A notice of proposed rulemaking was published on June 16th, 2017. A further notice of proposed rulemaking was published on July 24th, 2020. Portions of the first NPRM were adopted in a Report and Order notice published on July 24th, 2020. 

According to the 2026 Unified Agenda entry for this rulemaking: 

“In June 2017, the Commission began a rulemaking to streamline, consolidate, and harmonize rules governing earth stations in motion (ESIMs) used to provide satellite-based services on ships, airplanes and vehicles communicating with geostationary-satellite orbit (GSO), fixed-satellite service (FSS) satellite systems. In September 2018, the Commission adopted rules governing communications of ESIMs with GSO satellites. These rules addressed communications in the conventional C-, Ku-, and Ka-bands, as well as portions of the extended Ku-band. At the same time, the Commission also released a Further Notice of Proposed Rulemaking that sought comment on allowing ESIMs to operate in all of the frequency bands in which earth stations at fixed locations operating in GSO FSS satellite networks can be blanket-licensed. Specifically, comment was sought on expanding the frequencies available for communications of ESIMs with GSO FSS satellites to include the following frequency bands: 10.7-10.95 GHz, 11.2-11.45 GHz, 17.8-18.3 GHz, 18.8-19.3 GHz, 19.3-19.4 GHz, 19.6-19.7 GHz (space-to-Earth); and 28.6-29.1 GHz (Earth-to-space).” 

NOTE: The above UA agenda entry was posted in the ‘Long Term Actions’ portion of the Agenda with a note: “Next Action Undetermined”. It is unusual, but not unprecedented, for a rulemaking to so quickly change status. 

This rulemaking will only receive limited notice in this blog under my limited Space Geek coverage.