Short Takes – 9-12-26 - Federal Register Edition

RCRA Testing  

Request for Information on Test Methods for Evaluating Solid Waste (SW-846), Waste Sampling and Toxicity Characteristic Leaching Procedure (TCLP) Testing. EPA request for information. Summary: “EPA updates test methods and waste sampling guidance as part of routine updates according to the Resource Conservation and Recovery Act (RCRA). To aid in the implementation of these directives, the Office of Resource Conservation and Recovery (ORCR) within the Environmental Protection Agency (EPA) requests information on SW-846 method experiences, needs, and requirements. ORCR is specifically interested in information on the Toxicity Characteristic Leaching Procedure (TCLP) Method 1311, including method challenges, and alternatives. Information is welcome from stakeholders involved in requesting, performing, and evaluating the results from SW-846 methods including, but not limited to, industry stakeholders, researchers, academia, state, Tribal, and local governments. This includes U.S. territories and the District of Columbia, other federal agencies, community groups, non-governmental organizations, the public, and international organizations. The EPA will use the information received in response to this request for information (RFI) to inform what action, if any, it may take.” 

Space Geek  

Name of Information Collection: Proposal Submissions and Awards Management System (ProSAMS) for the NASA Small Business Innovation Research/Small Business Technology Transfer (SBIR/STTR) program Solicitations. NASA 30-day new information collection request notice. Summary: “The Small Business Innovation Research (SBIR) program is a highly competitive program that encourages domestic small businesses to engage in Federal Research/Research and Development (R/R&D) that has the potential for commercialization.... The Small Business Technology Transfer (STTR) is another program that expands funding opportunities in the federal innovation research and development (R&D) arena.” 

Executive Orders  

EO 14426 - Accelerating Access to Veterans' Benefits and Employment Opportunities. 

EO 14427 - Adjusting Certain Delegations Under the Defense Production Act. 

OMB Approves EPA Facility Response Delay Final Rule

Yesterday, the OMB’s Office of Information and Regulatory Affairs announced that it had approved a final rule from the EPA on “Clean Water Act Hazardous Substance Facility Response Plans: Compliance Date Delay and Changes to Reflect Administration Policy”. The notice of proposed rulemaking for this action was published on March 5th, 2026. This final rule was sent to OIRA on July 1st, 2026. 

According to the 2026 Unified Agenda entry for this rulemaking:  

“The Clean Water Act (CWA) Section 311(j)(5) provides that regulations shall be issued "which require an owner or operator of a tank vessel or facility ... to prepare and submit ... a plan for responding, to the maximum extent practicable, to a worst-case discharge, and to a substantial threat of such a discharge, of a hazardous substance." The Environmental Protection Agency (EPA) published a final rule in March 2024 to require planning for worst case discharges of CWA hazardous substances under section 311(j)(5)(A). Section 3 of the January 20, 2025, Executive Order 14154 Unleashing American Energy requires an immediate review of agency actions to identify those that may impose an undue burden on the identification, development, or use of domestic energy resources. As EPA considers options, the agency is proposing to extend the compliance date and make administrative changes” 

NOTE: OIRA classifies this as a ‘deregulatory’ action under EO 14192. 

Chemical Transportation Incidents – Week of 8-8-26

Reporting Background See this post for explanation, with the most recent update here (removed from paywall). 

Data from PHMSA’s online database of transportation related chemical incidents that have been reported to the agency. 

Incidents Summary  

• Number of incidents – 596 (561 highway, 28 air, 6 rail, 1 water) 
• Serious incidents – 4 (4 Bulk release, 0 evacuation, 0 injury, 0 death, 0 major artery closed, 2 fire/explosion, 30 no release)  
• Largest container involved – 33,920-gal DOT 117J100W Railcar {Petroleum Gases, Liquefied or Liquefied Petroleum Gas} B-End liquid valve had been left partially cracked open and the liquid line plug was found to be less than tool-tight. 
• Largest amount spilled – 2,087.3-gal ISO Tank {Carbon Dioxide, Refrigerated Liquid} Partially open valve. 
• Total amount reported spilled in all incidents – 6249.4-gal 

NOTE: Links above are to Form 5800.1 for the incident described. 

Most Interesting Chemical: Carbon Dioxide, Refrigerated Liquid: A colorless liquid. Relatively heavier than air and can asphyxiate by the displacement of air. Under prolonged exposure to heat or fire the container may rupture violently and rocket. Used as a refrigerant and in making carbonated beverages. Used to freeze food, to control chemical reactions and as a fire extinguishing agent. (Source: CameoChemicals.NOAA.gov).  

CISA Adds 2 MikroTik Vulnerabilities to KEV Catalog – 9-10-26

Yesterday, CISA announced that it was adding two vulnerabilities in the MikroTik OS to their Known Exploited Vulnerabilities (KEV) catalog. The two vulnerabilities are: 

• Missing authentication for critical function - CVE-2026-67277, and 
• Argument injection - CVE-2026-86060 

MikroTik reported both vulnerabilities on September 3rd, 2026. The two vulnerabilities were among six initially reported by Sławomir Rozbicki from CERT Polska, with fixed versions available. CERT Polska subsequently reported active exploitation in the wild on September 5th, citing proof-of-concept code developed by Nick Pratley using version diff analysis. 

Based upon the CERT Polska reports the following vulnerabilities may also end up being added to the KEV catalog: 

• Improper verification of cryptographic signature - CVE-2026-67276, CVE-2026-67278,  
• Improper enforcement of behavioral workflow - CVE-2026-67279, and 
• Path traversal - CVE-2026-67281 

CISA has directed federal agencies using the affected products to apply “mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s “Forensics Triage Requirements” [links added]. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable.” 

CISA has established a compliance date of September 13th, 2026.