HR 5109 Reported in House – TWIC for Felons

Yesterday, the House Homeland Security Committee reported HR 5109, a bill requiring TSA to “develop guidelines to improve returning [from incarceration] citizens’ access to the TWIC program.” A copy of the report is not currently available. The Committee held a business meeting on June 24th, 2026, that included consideration of the bill. The bill was approved by a vote of 30 to 0. 

The House is scheduled to consider the bill today under the suspension of the rules process. That process provides for limited floor debate; no amendments may be considered; and passage requires a super majority. 

Review – Bills Introduced – 9-15-26

Yesterday, with both the House and Senate in session, there were 47 bills introduced. I do not expect to provide additional coverage in this blog for any of those bills. 

Space Geek Legislation 

I would like to mention one bill under my limited Space Geek coverage in this blog: 

S 5398 A bill to establish the United States Space Academy as a service academy of the United States, to require that the Academy be located in the State of Florida, and for other purposes. Moody, Ashley [Sen.-R-FL]    

For more information on these bills, including legislative history for similar bills in the 118th Congress, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/bills-introduced-9-15-26 - subscription required. 

Review – 8 Advisories Published – 9-15-26

Today CISA’s NCCIC-ICS published eight control systems security advisories for products from CareCam, Siemens (3), Schneider Electric, myScada, Wärtsilä, and Digital Watchdog. 

Advisories  

CareCam Advisory - This advisory describes eight vulnerabilities in the CareCam CM2507. The vulnerabilities were reported to CISA by Ben Law. CISA notes that: “CareCam has not responded to CISA's attempts to coordinate.” 

Siemens Advisory #1 - This advisory describes a cross-site scripting vulnerability in the Siemens Teamcenter. The vulnerability was reported by Enzo Alvarez from Bishop Fox. 

Siemens Advisory #2 - This advisory describes an improper verification of cryptographic signature vulnerability in the Siemens Mendix SAML. The vulnerability was self-reported. 

Siemens Advisory #3 - This advisory discusses 14 vulnerabilities in the Siemens Reyrolle 7SR5 motor protection relay. Five of these are third-party (Cesanta Mongoose Web Server) vulnerabilities. 

Schneider Advisory - This advisory describes an insufficiently protected credentials vulnerability in the Schneider Electric SCADAPack x70 Products. The vulnerability was reported to CISA by Abhinav Agarwal. 

MyScada Advisory - This advisory describes two missing authorization vulnerabilities in the mySCADA myPRO Manager. These vulnerabilities were reported to CISA by Shirshak of Secnora OÜ. 

Wärtsilä Advisory - This advisory describes two use of hard-coded cryptographic key vulnerabilities in the Wärtsilä FOS-Onboard fleet optimization software. The vulnerabilities were reported by Cydome Security Ltd. 

Digital Watchdog - This advisory describes six vulnerabilities in the Digital Watchdog VMAX DVR and NVR Product Lineups. The vulnerabilities were reported to CISA by Scot Berner of TrustedSec. 

For more information on these advisories, as well as a DTRH looks at a POC and missing Siemens and Schneider advisories, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/8-advisories-published-9-15-26  - subscription required. 

Review - HR 10151 Introduced – Water System Assistance

Last month, Rep Deluzio (D,PA) introduced HR 10151, the Water Authority Cybersecurity Protection Act. The bill would amend 42 USC 300i-2(g), Technical assistance and grants, increasing the amounts available to the EPA for grants under subsections (4) and (5), increasing the amounts authorized for the Drinking Water Infrastructure Risk and Resilience Program, and extend the authorization for that program through 2029. 

This bill is essentially the same as HR 10389, the Water Authority Cybersecurity Protection Act, that was introduced by Deluzio in December 2024. That bill was introduced even later in the 118th Congress, and no action was taken. According to a press release from Deluzio’s office: 

“Any attack on our nation’s critical infrastructure is unacceptable, and the 2023 Iranian hack in Western Pennsylvania should have been a major wake-up call for our federal government,” said Congressman Deluzio. “Especially while the Iran War continues, we need to make sure our local water authorities have the resources and training they need to defend against cyber threats from the Iranians and others. Residents should be able to trust that their drinking water is safe from attacks. I am proud to reintroduce the Water Authority Cybersecurity Protection Act to help local leaders better secure our water system.” 

Moving Forward  

Neither Deluzio nor his sole cosponsor, Rep Finstad (R,MN), are members of the Energy and Commerce Committee to which this bill was assigned for consideration. This means that there will probably not be sufficient influence to see the bill considered by that Committee. While the increased funding would typically be considered an anathema to many Republicans, the recent spate of purported Iranian attacks on public water systems in this country, might outweigh the spending concerns in some members. While I would expect some level of bipartisan support if this bill was considered, I do not think that there would be enough support to allow the bill to be successfully considered under the suspension of the rules process. 

For more information on the provisions of this bill, as well as commentary on EPA grants for water system cybersecurity, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/hr-10151-introduced-water-system - subscription required. 

Short Takes – 9-12-26 - Federal Register Edition

RCRA Testing  

Request for Information on Test Methods for Evaluating Solid Waste (SW-846), Waste Sampling and Toxicity Characteristic Leaching Procedure (TCLP) Testing. EPA request for information. Summary: “EPA updates test methods and waste sampling guidance as part of routine updates according to the Resource Conservation and Recovery Act (RCRA). To aid in the implementation of these directives, the Office of Resource Conservation and Recovery (ORCR) within the Environmental Protection Agency (EPA) requests information on SW-846 method experiences, needs, and requirements. ORCR is specifically interested in information on the Toxicity Characteristic Leaching Procedure (TCLP) Method 1311, including method challenges, and alternatives. Information is welcome from stakeholders involved in requesting, performing, and evaluating the results from SW-846 methods including, but not limited to, industry stakeholders, researchers, academia, state, Tribal, and local governments. This includes U.S. territories and the District of Columbia, other federal agencies, community groups, non-governmental organizations, the public, and international organizations. The EPA will use the information received in response to this request for information (RFI) to inform what action, if any, it may take.” 

Space Geek  

Name of Information Collection: Proposal Submissions and Awards Management System (ProSAMS) for the NASA Small Business Innovation Research/Small Business Technology Transfer (SBIR/STTR) program Solicitations. NASA 30-day new information collection request notice. Summary: “The Small Business Innovation Research (SBIR) program is a highly competitive program that encourages domestic small businesses to engage in Federal Research/Research and Development (R/R&D) that has the potential for commercialization.... The Small Business Technology Transfer (STTR) is another program that expands funding opportunities in the federal innovation research and development (R&D) arena.” 

Executive Orders  

EO 14426 - Accelerating Access to Veterans' Benefits and Employment Opportunities. 

EO 14427 - Adjusting Certain Delegations Under the Defense Production Act.