Review – Pending Rules of Interest – EOY 2025

On the last day of 2025 it is a good time to take stock of the various rulemakings of interest here that are still pending review at OMB’s Office of Information and Regulatory Affairs. Of the 110 rules that are currently pending at OIRA, there are three from DOT, two from the EPA, one from the DOC, one from OMB, and one from the STB that will receive some coverage in this blog. There are no pending rulemakings of interest from CISA, DOL, DOJ, DOE, or the CSB.

 

For more details about these pending rulemakings, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/pending-rules-of-interest-eoy-2025 - subscription required.

Review – 1 Advisory and 1 Update Published – 12-30-25

Today CISA’s NCCIC-ICS published a control system security advisory for products from WHILL. They also updated an advisory for products from AzeoTech.

Advisories

WHILL Advisory - This advisory describes a missing authentication for critical function vulnerability in the WHILL Model C2 Electric Wheelchairs and Model F Power Chairs.

Updates

AzeoTech Update - This update provides additional information on the DAQFactory advisory that was originally published on December 11^th, 2025.

 

For more information on these advisories, including a down-the-rabbit-hole look at missing vulnerabilities, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/1-advisory-and-1-update-published-d1d - subscription required.

Review – HR 6042 Introduced – LANDED Act

Last month Rep Smith (R,NJ) introduced HR 6042, the Law Against Nefarious Drones, Enforcement, Deconfliction (LANDED) Act. The bill would provide authorization for state and local law enforcement personnel to conduct counter unmanned aircraft systems (cUAS) operations to mitigate a credible threats posed by an unmanned aircraft system. While the bill includes a new grant program, no new funding is authorized by the legislation.

HR 6042 is similar to HR 10555, the Law Against Nefarious Drones, Enforcement, Deconfliction (LANDED) Act, that was introduced by Smith in December 2024. No action was taken on that bill in the 118th Congress.

Moving Forward

Smith is not a member of the House Judiciary Committee to which this bill was assigned for primary consideration. This means that there is little chance that there will be sufficient influence to see the bill considered in Committee. I do not expect that Judiciary Committee would favorably consider this bill in any case because it glosses over too many of the issues related to countering UAS in the national airspace.

 

For more information on the provisions of this bill, as well as a commentary on the DOD IG UAS report, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/hr-6042-introduced-landed-act - subscription required.

Short Takes – 12-30-25 – Federal Register Edition

Safety Zone; Rocket Test Site, Rio Grande River, Boca Chica, TX. Federal Register CG notice of proposed rulemaking. Summary: “The Coast Guard is proposing to establish a permanent safety zone for certain navigable waters of the Rio Grande River. The safety zone is needed to protect personnel, vessels, and the marine environment from potential hazards created by cryogenics and structural tests of SpaceX rockets at their Massey's test site. This proposed rulemaking would prohibit persons and vessels from being in the safety zone unless specifically authorized by the Captain of the Port, Sector Corpus Christi. We invite your comments on this proposed rulemaking.” Comments due January 29^th, 2026.

TSCA Section 5 Premanufacture Review of New Chemical Substances and Significant New Use Rules for New and Existing Chemical Substances (Renewal). Federal Register EPA 30-day ICR renewal notice. Summary: “TSCA section 5 requires manufactures (which includes import) of a “new chemical substance” (i.e., a chemical not listed on the TSCA section 8(b) Inventory) must provide a premanufacture notice (PMN) to EPA at least 90 days prior to commencing manufacture of that chemical and that EPA review such notice and take appropriate action. Under TSCA, the term “chemical substance” includes microorganisms; the 90-day notice for microorganisms is a Microbial Commercial Activity Notice (MCAN).” Comments due January 29^th, 2026.

Public Meeting of the National Geospatial Advisory Committee. Federal Register USGS meeting notice. Summary: “In accordance with the Federal Advisory Committee Act (FACA) of 1972, the U.S. Geological Survey (USGS) is publishing this notice to announce that a Federal Advisory Committee meeting of the National Geospatial Advisory Committee (NGAC) will take place [on January 28^th and 29^th, 2026] and is open to members of the public.”

Review - S 438 Introduced – Cyber PIVOTT Act

Back in February Sen Rounds (R,SD) introduced S 438, the Providing Individuals Various Opportunities for Technical Training to Build a Skills-Based Cyber Workforce (Cyber PIVOTT) Act of 2025. The bill would require CISA to “establish education and training programs and facilitate internship and post-graduation Federal job opportunities at participating institutions”. No new funding would be authorized by this legislation.

This bill is very similar to HR 9770 that was introduced by Rep Green (R,TN) in September of 2024. On September 25^th, 2025. The House Homeland Security Committee held a markup hearing on September 25^th, 2024. The bill was amended and ordered to be reported favorably by a vote of 27 to 0. The report was never filed nor was an amended version of the bill published. No further action was taken.

On the same date that S 438 was introduced, Green introduced HR 1000 which was very similar to HR 9770. On February 26^th, 2025, the House Homeland Security Committee held a business meeting where HR 1000 was considered. The Committee ordered the bill reported favorably without amendment by a near party-line vote of 17 to 8. It is not clear why there was such a radical change in support from Democratic members of the Committee. No further action has been taken on HR 1000 in the 119^th Congress.

The differences between S 438 and HR 1000 are mostly formatting in nature with two exceptions. First, the definition section is expanded from 2 to 12 terms and is moved from subsection §1334(i) to (a). Secondly, a §1334(b)(5)(A)(ii) provides a broad FACA exemption to the advisory committee suggested in clause (i).

This bill would amend the Homeland Security Act of 2002 by adding a new section: §1334, CISA education and training programs and resources.

Moving Forward

While Rounds is not a member of the Senate Homeland Security and Governmental Affairs Committee to which this bill was assigned for consideration, his sole cosponsor {Sen Peters (D,MI)} is the Ranking Member of that Committee. This means that there could be sufficient influence to see the bill considered in Committee. With no spending authorized in the legislation, I see nothing in the bill that would engender any organized opposition. I suspect that there would be some level of bipartisan support for the bill.

As with any bill under primary consideration of the Senate Homeland Security Committee, the main roadblock could be opposition by the Chair, Sen Paul (R,KY). Paul has an almost visceral objection to government programs, so it would not be surprising if he were to object to this PIVOTT program. And since he is the Chair, his objection would mean that the bill would not be considered by the Committee.

 

For more information on the provisions of this bill, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/s-438-introduced-cyber-pivott-act - subscription required.

Review – HR 5304 Introduced – FY 2026 LHH Spending

Back in September Rep Aderhold introduced HR 5304, the Departments of Labor, Health and Human Services, and Education, and Related Agencies Appropriations Act, 2026. The House Appropriations Committee published their Report on the bill. The bill contains specific spending authorizations for cybersecurity activities and CBRN response initiatives. The Report contains cybersecurity, chemical safety and UAS discussions.

HR 5304 is similar to HR 9029, the Labor, Health and Human Services, and Education, and Related Agencies [LHH] Appropriations Act, 2025, that was introduced by Alderholt in July, 2024. The House Appropriations Committee published their Report on the bill the same day. No further action was taken on that bill (or its Senate counterpart, S 4942) in the 118th Congress. The Senate version of the FY 2026 LHH spending bill, S 2587, may be included in the text of the substitute language that will be considered for HR 4016 when the Senate comes back to Washington in January.

Moving Forward

It does not currently look like the House will take up this bill as this is one of the more controversial spending bills, even within the Republican caucus. Spending hawks do not think that enough cuts were made, and moderates are concerned with some of the language related to abortions, transgender issues, and vaccine support. It still looks like the Senate will include the language from their more moderate LHH spending bill as a Division in the language they have been ‘debating’ for HR 4016, the FY 2026 DOD spending bill. The Senate leadership is working towards considering that minibus spending bill early in July. What ever spending bills remain unpassed at the end of the month will likely be dealt with under a year-end continuing resolution, hopefully before the current CR runs out on January 31^st.

 

For more information on the cybersecurity and chemical safety provisions of the bill, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/hr-5304-introduced-fy-2026-lhh-spending - subscription required.

Review – HR 6315 Introduced – Election System Pentests

Earlier this month Rep Valadao (R,CA) introduced HR 6315, the Strengthening Election Cybersecurity to Uphold Respect for Elections through Independent Testing (SECURE IT) Act. The bill would amend the Help America Vote Act of 2002, by adding to the existing election system certification system a requirement to conduct 3^rd party penetration testing of such systems. It would also establish a voluntary elections system vulnerability disclosure program. No new funding is authorized by the legislation.

HR 6315 is essentially the same as HR 7447, the Strengthening Election Cybersecurity to Uphold Respect for Elections through Independent Testing (SECURE IT) Act, that was introduced by Rep Spanberger (D,VA) in February 2024; Valadao was a cosponsor of that bill. No further action was taken on that bill in the 118^th Congress.

Moving Forward

Neither Valadao, nor his sole cosponsor {Rep Deluzio (D,PA)}, are members of the House Administration Committee to which this bill was assigned for primary consideration. This means that there is not sufficient influence to see the bill considered in Committee. I suspect that there would be some level of bipartisan support for the bill were it to be considered. What is not clear is if there would be enough to see the bill considered by the full House under the suspension of the rules process.

Commentary

While the proposed §231(e) uses the term ‘penetration testing’ it does not provide a definition of that term. I would suggest using the definition of that term found in NIST SP 800-115, Technical Guide to Information Security Testing and Assessment (pg F1):

“Security testing in which evaluators mimic real-world attacks in an attempt to identify ways to circumvent the security features of an application, system, or network. Penetration testing often involves issuing real attacks on real systems and data, using the same tools and techniques used by actual attackers. Most penetration tests involve looking for combinations of vulnerabilities on a single system or multiple systems that can be used to gain more access than could be achieved through a single vulnerability.”

 

For more details about the provisions of the bill, including additional commentary on the definition of penetration testing, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/hr-6315-introduced-election-system - subscription required.

Chemical Incident Reporting – Week of 12-20-25

NOTE: See here for series background.

Olean, NY – 12-23-25

Local News Report: Here, here, and here.

There was a chlorine gas leak at a hotel swimming pool. The building was evacuated. One person was transported to a local hospital for inhalation injuries.

Possible CSB Reportable.

Jasper, AR – 12-23-25

Local News Report: Here, here, here, and here.

There was a traffic accident involving a propane truck that overturned and began leaking. Evacuations were ordered for the surrounding community. One person was injured.

Not CSB reportable; transportation incident.

Channelview, TX – 12-27-25

Local News Report: Here and here.

There was a sulfuric acid spill at a chemical manufacturing facility. Two people were injured and sent a local hospital.

Possible CSB reportable.

Review – Public ICS Disclosures – Week of 12-20-25

This was a relatively light Christmas week for disclosures. We have seven vendor disclosures from Delta Electronics, Eaton (3), Hitachi (2), and Ruckus. We also have four exploits for products from FortiGuard, HP (2), and HPE.

Advisories

Delta Advisory - Delta published an advisory that describes a cleartext transmission of sensitive information in their DVP-12SE PLC.

Eaton Advisory #1 - Eaton published an advisory that describes an uncontrolled search path vulnerability in their UPS Companion (EUC) Software.

Eaton Advisory #2 - Eaton published an advisory that describes two uncontrolled search path element vulnerabilities in their UPS Companion (EUC) software.

Eaton Advisory #3 - Eaton published an advisory that describes an improper input validation vulnerability in their xComfort ECI.

Hitachi Advisory #1 - Hitachi published an advisory that discusses two vulnerabilities in their Infrastructure Analytics Advisor and Ops Center Analyzer products.

Hitachi Advisory #2 - Hitachi published an advisory that discusses 35 vulnerabilities in their Disk Array products.

Ruckus Advisory - Ruckus published an advisory that discusses the Qualcomm U-boot vulnerability.

Exploits

FortiGuard Exploit - Indoushka published an exploit for an SQL injection vulnerability in the FortiGuard FortiWeb Fabric Connector.

HP Exploit #1 - Indoushka published an exploit for a PHP code injection vulnerability in the HP ProCurve SNAC Domain Controller.

HP Exploit #2 - Indoushka published an exploit for a credential dumping attack on the HP ProCurve SNAC Domain Controller.

HPE Exploit - Remmons-r7, et al, published a Metasploit module for a code injection vulnerability in the HPE One View product.

 

For more information on these disclosures, including links to 3^rd party advisories, researcher reports, and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-12-218 - subscription required.

Short Takes – 12-26-25 – Space Geek

Astronomers Find A Rogue Planet Devouring Billions Of Tons Every Second. Astronex.net article. Pull quote: “Detecting accretion in faint, distant rogue planets requires sensitive instruments capable of capturing spectral signatures. For Cha 1107-7626, the team used the X-shooter spectrograph on ESO’s VLT to obtain optical and near-infrared spectra, alongside mid-infrared data from JWST’s MIRI and NIRSpec instruments. These observations spanned from April to August 2025, revealing a transition from a quiescent state to heightened activity.”

Russia patents space station designed to generate artificial gravity. Space.com article. Pull quote: “A report from Russian state media outlet TASS, which obtained the patent, states that the rotating system is designed to generate a gravitational force of 0.5g, or 50% of Earth’s gravity. The patent documentation includes illustrations of a notional space station structure with a central axial module with both static and rotating components, with modules and habitats connected by a hermetically sealed, flexible junction.”

India's space agency launches its heaviest satellite yet. DW.com article. Pull quote: “The LVM3-M6 rocket, a launch vehicle developed by the Indian Space Research Organization (ISRO), was launched at 8.55 a.m. local time (0330 GMT). The satellite, built by the US-based company AST SpaceMobile, was successfully injected into the intended orbit, the ISRO said.”

Scientists spot 'unprecedented celestial event' around the 'Eye of Sauron' star just 25 light-years from Earth. LiveScience.com article. Pull quote: “Yet when this supposed planet blinked out of existence and another bright point of light appeared nearby, all in the span of approximately 20 years, researchers realized they weren't viewing planets, but the shining debris clouds formed by what they call a "cosmic fender bender."”

An asteroid could hit the moon in 2032, scattering debris toward Earth. ScienceNews.org article. Pull quote: “If YR4 hit the moon, there’s an 86 percent chance it would do so on the side facing Earth. If it did, the impact would generate a flash that “should probably be visible [from Earth] depending on the local viewing conditions,” said astronomer Patrick King, who simulated the impact’s brightness and presented his results at the meeting.”

Elon Musk’s Starlink satellites could be targeted by new Russian weapon, Nato warns. Independent.co.uk article. Pull quote: “Such a weapon could potentially disable multiple satellites at once, but it also carries the risk of catastrophic collateral damage to other orbiting systems. The alleged objective behind this development is to curb Western space superiority, which has played a crucial role in aiding Ukraine on the battlefield.”

Long March 12A reaches orbit in first reusable launch attempt, but landing fails. SpaceNews.com article. Pull quote: “The first stage was expected to perform a reentry burn after separation and target a landing at a pad located around 250 kilometers downrange in Minqin county, Gansu province. Apparent images and satellite imagery shared on social media suggested that the landing was unsuccessful, potentially landing around two km away from the pad.”

• A dying satellite could use its final moments to photograph the infamous asteroid Apophis in 2029,

• Chandrayaan-3 successfully undertakes lunar flybys,

• ESA leaders greenlight $1.6 billion for new ‘non-aggressive’ space security initiative,

• Antares raises $96 million for nuclear reactors on Earth and in space,

• Shield AI partners with Sedaro to demonstrate autonomous satellite operations,

• The next steps in the quest for full rocket reusability, and

• The overlooked space race: keeping satellites alive.

Chemical Transportation Incidents – Week of 11-22-25

Reporting Background

See this post for explanation, with the most recent update here (removed from paywall).

Data from PHMSA’s online database of transportation related chemical incidents that have been reported to the agency.

This is the second week where I have not had access to the PHMSA database to prepare this report. The web site continues (since December 12th) to display the same ‘explanation’:

“Hazmat Incident Report Search Tool
The ability to download pdf copies of incident filings or download complete datasets of the search results has been temporarily disabled. If you need pdf copies of incidents or relevant search criteria, please email relevant incident numbers to HMRequests@dot.gov.”

On December 12^th, I requested a copy of the database for the week of  November 8^th thru 14^th. I received two separate databases, but only one included all of the data that I have been using in this blog series. The other was just about twice as large, containing a number of additional data columns. In any case, I used the first to prepare my post on December 13^th.

Last week, I again requested a copy of database for the week of November 15^th thru 21^st, 2025. This time I received just the larger of the two DB copies. Assuming that the DB copy just included additional columns of information that was not in the smaller version, I tried to extract the same columns of information that I had been using, but was not able to do so. It appears that the smaller version may, in some instances, consolidate information found in multiple columns found in the larger DB copy.

This week, with the government on an extended Christmas holiday, I will not be requesting copies of the database for this week’s post. I will resume next week.

OMB Approves PHMSA Fuel Transportation Final Rule – 12-23-25

On Tuesday the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had approved a final rule from DOT’s Pipeline and Hazardous Materials Safety Administration (PHMSA) on “Eliminating Unnecessary Burdens On Fuel Transportation ”. The notice of proposed rulemaking (NPRM) was published on October 28^th, 2024.

According to the Spring 2025 Unified Agenda entry for this rulemaking:

“PHMSA is adopting several amendments to the Hazardous Materials Regulations to reduce unnecessary regulatory burdens associated with the safe transportation of hazardous materials, including energy products, in commerce. These amendments will reduce costs on hazardous materials transporters and eliminate unnecessary regulatory burdens on fuel transportation while maintaining or increasing the level of safety provided in the Hazardous Materials Regulations.”

This certainly sounds like the rulemaking is in response to the deregulatory demands of  EO 14154, Unleashing American Energy. An alert reader will have noticed, however, that the NPRM for this rulemaking was published under the Biden Administration under the title of “Hazardous Materials: Advancing Safety of Highway, Rail, and Vessel Transportation”. To be fair, the rulemaking was initiated under the 45 Administration as the “Hazardous Materials: Modal Regulatory Reform Initiatives”.

The first mention of this rulemaking showed up in the Fall 2018 Unified Agenda:

“This rulemaking amends the Hazardous Materials Regulations (HMR; 49 CFR parts 100-185) to adopt a number of actions that will ease regulatory burdens on modal transportation while continuing to protect our communities from the risks inherent to transporting hazardous materials. These modal-specific (e.g., rail, highway, and vessel) amendments include deregulatory actions identified by internal agency review and public comments on the Department of Transportation regulatory reform and infrastructure notices.”

Biden’s PHMSA slightly modified that description in the Spring 2021 Unified Agenda:

“This rulemaking would amend the Hazardous Materials Regulations to adopt a number of modal specific amendments that would enhance the safe transportation of hazardous materials. PHMSA, in consultation with the Federal Motor Carrier Safety Administration, the Federal Railroad Administration, and the United States Coast Guard, proposes amendments identified during Departmental review and from industry petitions for rulemaking.”

The final rule should be published in the Federal Register in early January.

Short Takes – 12-24-25

Civil Monetary Penalty Adjustments for Inflation. Federal Register CG & TSA final rule. Summary: “On January 2, 2025, DHS adjusted for inflation its civil monetary penalties for 2025, in accordance with the Federal Civil Penalties Inflation Adjustment Act Improvements Act of 2015 and Executive Office of the President (EOP) Office of Management and Budget (OMB) guidance. The new penalty amounts were effective for penalties assessed after January 2, 2025, whose associated violations occurred after November 2, 2015. DHS is making a technical amendment to the Code of Federal Regulations to make several clerical revisions to the codified 2025 penalty amounts.” Effective date: December 29^th, 2025.

TUESDAY MEASLES UPDATE: DPH Reports Nine New Measles Cases in Upstate, Bringing Outbreak total to 153. DPH.SC.gov press release. Pull quote: “The South Carolina Department of Public Health (DPH) is reporting 9 new cases of measles in the state since Friday, bringing the total number of cases in South Carolina related to the Upstate outbreak to 153 and the total number reported to DPH this year to 156.”

Here's Where Measles Case Counts Are Highest. MedPageToday.com article. Pull quote: “A large measles outbreak began in West Texas on Jan. 20, 2025 and was declared over in August. But scientists are studying whether the D8-9171 measles strains circulating in Utah and Arizona are related to that outbreak, according to the Yale report.”

Weapons maker says it's seeing surging European interest in new kits that turn machine guns into drone-killers. BusinessInsider.com article. Pull quote: “When activated, the system lets a soldier hold down the trigger while Arbel automatically releases rounds at the moments they're most likely to hit the target. It can bring down drones at roughly 450 meters in daylight and 200 meters at night.”

Capturing Rogue Drones. HomelandSecurityNewswire.com article. Pull quote: “Also newly integrated is an in-house target acquisition system. It relies on LiDAR sensors to detect a potential target object, after which a camera uses AI to verify it. “This ensures that the object really is a drone and not, for instance, a bird,” Rothe adds. ”

NIST, MITRE announce $20 million research effort on AI cybersecurity. CyberScoop.com article. Pull quote: “But in order to help, Barlet said that NIST and the government must ensure those sectors have a meaningful seat at the table and can translate any research insights into workable solutions. Getting those parties on board will be crucial because, he said, those are the people “who will be answering to Congress if something goes wrong, not the AI developers.””

AI Is About to Transform Nuclear Energy, and the United States Isn’t Ready. NationalInterest.com article. Pull quote: “I work at the intersection of nuclear regulation, international trade controls, and the emerging advanced-reactor industry. And in that space I can attest that the convergence of nuclear and AI is no longer theoretical —it is the daily reality of developers, government partners, and defense planners. The most sophisticated advanced reactor companies already treat software and data as core components of their safety and engineering philosophy. Cloud-native modeling environments, AI-assisted design optimization tools, automated supply chain verification systems, and data-rich remote operations platforms are now embedded in the DNA of the new generation of reactors and the companies that are developing them. And it has implications for all levels of regulation of the nuclear energy industry.”

COVID Vaccines Slashed Kids’ ER Visits by 76 Percent, Study Finds. ScientificAmerican.com article. Pull quote: “The new study [link added] looked at a period spanning from August 29, 2024, through September 2, 2025, across nine states. During that time, about 38,000 children were hospitalized with COVID—a rate of about 53 per 100,000. The highest rate was in children younger than six months old, of whom 600 per 100,000 were hospitalized. Children under six months of age are too young to get vaccinated, but vaccination during pregnancy provides some protection for those first six months.”

‘Ghost Fire’ in Marshes Sparked by Strange Chemistry. ScientificAmerican.com article. Pull quote: “Now a paper published in the Proceedings of the National Academy of Sciences USA seems to provide an answer: microlightning, or tiny, spontaneous sparks of electricity that occur because of differences in charge on water droplets’ surfaces. These droplets form when water bubbles containing methane rise and burst at the surface of the marsh, and the resulting sparks ignite the methane to create will-o’-the-wisps’ telltale luminescence.”

Backlog List – Medical

First Documented Death From Meat Allergy Tied to Tick Bite,

Why ‘subclade K’ could make for a nasty flu season,

What to Know About the H3N2 Flu Strain That Has Experts Concerned,

Measles cases surge as deaths decline globally: WHO,

Bats might be the next bird flu wild card, and

Hundreds quarantined as South Carolina measles outbreak accelerates.

Review – CSB Publishes Interim Recommendations in Coke Explosion Investigation

Yesterday the Chemical Safety Board (CSB) announced that they were taking the unusual step of publishing two safety recommendations relatively early in their investigation of the fatal explosion and fire at the U.S. Steel Clairton Coke Works on August 11^th. 2025. The CSB published an initial description of the incident on September 29^th, 2025. The final report on this investigation, when completed, may contain additional recommendations.

Yesterday’s action brings the total number of CSB incident investigation recommendations to 1027, with 121 recommendations still open. Currently there are nine open CSB investigations, including the Coke Works inquiry.

 

For more information on yesterday’s announcement, the recommendations, and the reason for issuing these interim recommendations, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/csb-publishes-interim-recommendations - subscription required.

Review - HR 6429 Introduced – Diverse Cybersecurity Workforce

Earlier this month, Rep Brown (D,OH) introduced HR 6429, the Expanding Cybersecurity Workforce Act of 2025. The bill would require CISA to establish, within their current Cybersecurity Education and Training Assistance Program (CETAP), a new program to promote the cybersecurity field to disadvantaged communities. It would authorize $20 million per year through 2030 to support the program

HR 6429 is essentially the same as HR 8469, the Diverse Cybersecurity Workforce Act of 2024, that was introduced by Brown in May 2024. No additional actions were taken on that bill in the 118^th Congress.

Moving Forward

While Brown is not a member of the House Homeland Security Committee to which this bill was assigned for consideration, five of her 29 cosponsors {Ranking Member Thompson (D,MS), Rep Goldman (D,NY), Rep Ramirez (D,IL), Rep Johnson (D,TX), Rep Carter (D,LA)} are members. This means that there may be sufficient influence to see the bill considered in Committee, but with the lack of any Republican cosponsor (because this is, after all a diversity program), and adding a new program to CISA’s workforce development slate, means that the legislation will have a hard-time getting enough support form committee republicans to be able to move the program to the floor of the House under the suspension of the rules process.

 

For more details about the provisions of this bill, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/hr-6429-introduced-diverse-cybersecurity subscription required.

Review – 1 Update Published – 12-23-25

Today CISA’s NCCIC-ICS published an update for an advisory for products from Mitsubishi.

Advisories

Mitsubishi Update  - This update provides additional information on the Air Conditioning Systems advisory that was originally published on June 26^th, 2025, and most recently updated on August 21^st, 2025.

 

For more information on these advisories, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/1-update-published-12-23-25 - subscription required.

Short Takes – 12-23-25 – Federal Register Edition

Security Zones; Vessels Carrying Dangerous Cargo, Corpus Christi and La Quinta Ship Channels, Corpus Christi, TX. Federal Register CG notice of proposed rulemaking. Summary: “The Coast Guard is proposing to establish a security zone around vessels carrying Certain Dangerous Cargos (CDCs), for which the Captain of the Port, Corpus Christi deems enhanced security measures are necessary on a case-by-case basis. This security zone is needed to safeguard these vessels, the public, and the surrounding area from sabotage or other subversive acts, accidents, or other events of a similar nature. We invite your comments on this proposed rulemaking.” Comments due January 22^nd, 2026.

Petition To Delist Hazardous Air Pollutant: 2-Butoxyethyl Benzoate (2-BEB). Federal Register EPA notice of proposed rulemaking. Summary: “The U.S. Environmental Protection Agency (EPA or Agency) is proposing to grant a petition to remove 2-Butoxyethyl benzoate (2-BEB) (Chemical Abstract Service (CAS) No. 5451-76-3) from the glycol ethers category in the list of hazardous air pollutants (HAP) in Clean Air Act (CAA). The EPA proposes to find that there are adequate data on the health or environmental effects of 2-BEB to support the request for removal. This action also details a streamlined approach to the review process of future petitions.” Comments due February 20, 2026.

EO 14368 - Adjustments of Certain Rates of Pay. Federal Register.

EO 14369 - Ensuring American Space Superiority. Federal Register.

EO 14370 - Increasing Medical Marijuana and Cannabidiol Research. Federal Register.

EO 14371 - Providing for the Closing of Executive Departments and Agencies of the Federal Government on December 24, 2025, and December 26, 2025. Federal Register.

BIS Withdraws Rare Earths Export IFR

Yesterday the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that the DOC’s Bureau of Industry and Security (BIS) had withdrawn their interim final rule (IFR) on “Revisions to the Export Administration Regulations: Rare Earth Minerals and Strategic Metals”. The IFR was sent to OIRA on July 10^th, 2025.

According to the Spring 2025 Unified Agenda Entry for this rulemaking:

“This rule makes revisions to the Export Administration Regulations (EAR) for certain rare earth minerals and strategic metals.”

That description of the purpose of the rulemaking is way short on details, but I would assume that it was part and parcel of the Administration’s on-again, off-again disagreement with the Chinese about trade in rare earth materials. This follows a November BIS suspension of an entities list IFR that impacted Chinese trade.

OMB Approves BIS Drone Export IFR

Yesterday the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had approved an interim final rule (IFR) from the DOC’s Bureau of Industry and Security on “Streamlining Export Controls for Drone Exports”. The IFR was sent to OIRA on August 21^st, 2025. This rulemaking was not reported in the Spring 2025 Unified Agenda.

I will probably not be covering this IFR in any detail when it is published, probably after Christmas, in the Federal Register. I will at least note the publication in the appropriate Short Takes post.

CISA Adds Digiever Vulnerability to KEV Catalog – 12-22-25

Yesterday CISA announced that it had added a missing authorization vulnerability in the Digiever DS-2105 Pro, a Linux-embedded standalone NVR. The vulnerability was first reported by Ta-Lun Yen of TXOne Research in 2023. At that time Digiever reported that the DS-2105 Pro had been end-of-life for five years and no fix was planned. Akamai reported in 2024 that they had spotted the vulnerability being exploited in their honey pots in November 2024, and was actively being exploited to spread Miri variant malware. The TXOne report includes generic mitigation measures that may be applicable.

CISA has notified federal agencies using the DS-2105 Pro to apply “mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.” A deadline of January 12^th, 2025 has been set to accomplish those actions.

Review – S 3068 Introduced – AG Right-to-Repair

Sen Welch (D,VT) introduced S 3068, the Freedom for Agricultural Repair and Maintenance (FARM) Act. The bill would require covered original equipment manufacturers (OEM) to make available any documentation, part, software, firmware, or tool intended for use in order to diagnose, maintain, upgrade, reprogram, or repair farm equipment. It would also require OEM to make available to owners any farm equipment data generated by the farm equipment of the owner. No new funding is authorized by this bill.

The bill is very similar to HR 5604, the Agricultural Right to Repair Act, introduced by Rep Perez (D,WA) in September 2023. No action was taken on that bill in the 118^th Congress. Most of the differences between the two bills are editorial. The major changes in S 3068 include:

Removing the definition of the ‘embedded software’,

Adding the definition of ‘maintenance’, and

Adding additional enforcement authority for the FTC.

Moving Forward

While Welch is not a member of the Senate Commerce, Science, and Transportation Committee to which this bill was assigned for consideration, one of his two cosponsors, Sen Fetterman (D,OH) is a member. This means that there may be sufficient influence to see the bill considered in Committee. I suspect, however, that there will be substantial opposition to this bill among the Republican members of the Committee, so the bill will not likely be taken up by the Committee.

 

For more details about the provisions of this bill, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/s-3068-introduced-ag-right-to-repair - subscription required.

S 2983 Introduced – Cyber Info Sharing

Back in October Sen Peters (D,MI) introduced S 2983, the Extending Expired Cybersecurity Authorities Act. The bill would extend the Cybersecurity Information Sharing Act through September 30^th, 2035. It would also revise the title of that act to read “Protecting America from Cyber Threats Act”.

One provision of this short bill will no longer be necessary. Section 2(b) would make the extension retroactive to October 1^st, 2025. When this bill was written the Cybersecurity Information Sharing Act had expired on September 30^th. Section 149 of the Continuing Appropriations, Agriculture, Legislative Branch, Military Construction and Veterans Affairs, and Extensions Act, 2026 (PL 119-37) extended this authority until January 30^th, 2026.

Moving Forward

Peters is the Ranking Member of the Senate Homeland Security and Governmental Affairs Committee to which this bill would normally have been assigned for consideration. Instead, this bill was placed directly on the Senate Legislative Calendar under General Orders. Calendar No. 182. This means that the bill could be called up at any time for consideration by the full Senate. Still, the impetus for early consideration of the bill has eased, and it is not likely to be considered until after January 30^th. Of course, if a spending bill or yet another continuing resolution further extends the 6 USC 1510(a) (Note: this version of the section still has not been updated for PL 119-37) termination date, then there will be little political pressure to take up this bill.

Review – HR 4344 Introduced – Resilient PNT Demonstration

Back in July Rep Mullin (D,CA) introduced HR 4344, the Resilient Low Earth Orbit Positioning, Navigation, and Timing (Resilient LEO PNT) Act. The bill would require the Department of the Air Force (DAF) to “carry out a capability demonstration project, to be known as the “Commercial Low Earth Orbit Resilient Positioning, Navigation, and Timing Capability Demonstration””. The “Pathfinder Program” would be conducted subject to the availability of appropriations, effectively passing the spending authorization requirement to the appropriations committees.

I can find no bills in the 118th Congress that look to be similar to HR 4344. ‘Positioning, navigation and timing’ topics are of interest here because of the use of the ‘timing’ feature in these systems by a number of SCADA systems to coordinate operations at disparate locations.

Moving Forward

While Mullan is not a member of the House Armed Services Committee to which this bill was assigned for consideration, one of this two cosponsors, Rep Wittman (R,VA) is a member. This means that there may be sufficient influence to see this bill considered in committee. Lacking any specific funding authorization, I see nothing in this bill that would engender any organized opposition. Having said that, I also suspect that there could still be some resistance to supporting a bill that would potentially cost an unspecified, but significant, amount of money. Still, I would suspect that there would be some level of bipartisan support for this bill were it to be considered.

Commentary

The ability to ‘restore service’ in a timely manner is going to be an increasing requirement for DOD satellite services. This means that the vendor is going to need to demonstrate the capability to launch replacement satellites on a near demand basis.  Depending on the size and weight of the satellite, there are an increasing number of launch providers that could provide relatively quick response launch capabilities. This also means that the PNT service provider is probably going to have to have some number of satellites on hand, available to launch and activate when needed.

 

For more information on the provisions of this bill, including additional commentary on satellite resiliency, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/hr-4344-introduced-resilient-pnt - subscription required.

Chemical Incident Reporting – Week of 12-13-25

NOTE: See here for series background.

La Porte, TX – 12-9-25

Local News Report: Here, here, and here.

There was a fire at a chemical manufacturing facility. There were no reports of injuries or description of damages.

Not CSB reportable.

 

PHMSA Sends Spacecraft HAZMAT ANPRM to OMB

Yesterday the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had received an advanced notice of proposed rulemaking from the DOT’s Pipeline and Hazardous Material Safety Administration (PHMSA) on “Hazardous Materials: Modernizing Regulations to Facilitate Transportation of Spacecraft and Space Related Hazardous Materials”.

According to the Spring 2025 Unified Agenda entry for this rulemaking:

“In this rulemaking, PHMSA would amend the Hazardous Materials Regulations (HMR) to modernize and streamline the HMR, where necessary, to facilitate the transportation of hazardous materials involved in U.S. space operations. PHMSA will aim to identify problems and friction with the current regulatory scheme and potentially reduce burdens on both PHMSA and the regulated community while advancing U.S. interests in the space industry. PHMSA would coordinate closely with its interagency partners (Department of Defense, National Aeronautics and Space Administration, etc.) and its modal partners (Federal Aviation Administration, Federal Motor Carrier Safety Administration, Federal Railroad Administration, and U.S. Coast Guard) to ensure a comprehensive approach that allows for the seamless movement of goods across multiple modes of transport while allowing for the specific needs of each mode to be safely addressed.”

Review – Public ICS Disclosures – Week of 12-13-25

This week we have 11 vendor disclosures from Broadcom, HP, HPE (3), Inaba Denki Sangyo, Moxa, Phoenix Contact, and Western Digital (3). There are three vendor updates from Cisco, HPE, and Mitsubishi. There are also four researcher reports about vulnerabilities in products from Grassroot (3) and Sante. Finally, we have an exploit for products from Ilevia.

Advisories

Broadcom Advisory - Broadcom published an advisory that discusses the Meta RSC vulnerability that is listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog.

HP Advisory - HP published an advisory that describes an insertion of sensitive information into a log file vulnerability in the their Poly Video product line.

HPE Advisory #1 - HPE published an advisory that discusses two vulnerabilities (one with publicly available exploits) in their Unified OSS Console Assurance Monitoring product.

HPE Advisory #2 - HPE published an advisory that discusses three vulnerabilities (one with publicly available exploits) in their Telco Service Activator products.

HPE Advisory #3 - HPE published an advisory that describes a code injection vulnerability in their OneView software.

Inaba Advisory - JP-CERT published an advisory that describes three vulnerabilities in the Inaba CHOCO TEI WATCHER mini.

Moxa Advisory - Moxa published an advisory that describes a weak SSH algorithms supported vulnerability in their EDS-510E Series products

Phoenix Contact Advisory - Phoenix Contact published an advisory that describes 15 vulnerabilities in their FL SWITCH 2xxx family.

Western Digital Advisory #1 - Western Digital published an advisory that discusses a detection of error condition without action vulnerability in their My Cloud OS 5 product.

Western Digital Advisory #2 - Western Digital published an advisory that describes a DLL hijacking vulnerability in their WD Discovery product.

Western Digital Advisory #3 - Western Digital published an advisory that discusses a detection of error condition without action vulnerability in their My Cloud Home and My Cloud Home Duo products.

Updates

Cisco Update - Cisco published an update for their REACT server advisory that was originally published on December 4^th, 2025, and most recently updated on December 11^th, 2025.

HPE Update - HPE published an update for their Compute Scale-up Server 3200 Platform advisory that was originally published on October 13, 2025.

Mitsubishi Update - Mitsubishi published an update for their MELSOFT Update Manager advisory that was originally published on July 3^rd, 2025.

Researcher Reports

Grassroot Reports - Cisco Talos published three reports describing four vulnerabilities in the Grassroots DICOM product.

Sante Report - The Zero Day Initiative published a report describing a NULL pointer dereference vulnerability in the Sante PACS server.

Exploits

Ilevia Exploit - Indoushka published an exploit for an OS command injection vulnerability in the Ilevia EVE X1 Server.

 

For more information on these disclosures, including links to 3^rd party advisories, researcher reports, and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-12-d12 - subscription required.

CISA Adds WatchGuard Vulnerability to the KEV Catalog – 12-29-25

Today CISA announced that it had added an out-of-bounds write vulnerability in the WatchGuard Firebox to their Known Exploited Vulnerabilities (KEV) catalog. WatchGuard published their advisory for the vulnerability yesterday, and updated that advisory with indicators of exploit information. WatchGuard has new versions that mitigate the vulnerability.

CISA has directed federal agencies that use the affected devices to apply  mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. A deadline was set for December 26^th, 2025, to accomplish those actions.

Review – Bills Introduced – 12-18-25

Yesterday, with both the House and Senate in their last day in Washington for 2025, there were 116 bills introduced. One of those bills will receive additional coverage in this blog:

HR 6846 To amend the Homeland Security Act of 2002 to require the Secretary of Homeland Security to conduct annual assessments on terrorism threats to the United States relating to the malicious use of unmanned aircraft systems by covered foreign adversaries, including terrorist organizations, and for other purposes. Crane, Elijah [Rep.-R-AZ-2]

 

For more information on these bills, including legislative history for similar bills in the 118^th Congress, as well as a mention in passing of a bill to require DOE to produce a national threat assessment, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/bills-introduced-12-18-25 - subscription required.

S 2866 Sponsor Added – Ag Cybersecurity

Last week two sponsors were added to S 2866, the Cybersecurity in Agriculture Act of 2025. One, Sen Schiff (D,CA) is a member of the Senate Agriculture, Nutrition, and Forestry Committee to which this bill was assigned for consideration. This means that there may now be enough influence to see the bill considered in Committee. It also increases the chance that this language could be added to an agriculture authorization bill.

The bill would require the National Institute of Food and Agriculture (NIFA) to establish five Regional Agriculture Cybersecurity Centers (RACC) to carry out research, development, and education on agriculture cybersecurity. The bill would amend the National Agricultural Research, Extension, and Teaching Policy Act of 1977, adding a new §1473I. The bill would authorize $25 million in annual spending to support the Centers through 2030.

The money authorized in this bill continues to be a major drawback to its consideration in this Congress.

Review – HR 3207 Introduced – UAS Counter Measures for Public Gatherings

Back in May Rep Steube (R,FL) introduced HR 6207, the Disabling Enemy Flight Entry and Neutralizing Suspect Equipment (DEFENSE) Act. The bill would amend 6 USC 124n, adding a new subsection (m), Stadium Security. It would authorize DHS and DOJ to deputize a State or local law enforcement officer to exercise the authority granted by §124n(a) with respect to large public gatherings. No new funding is authorized by this bill.

Moving Forward

While Steube is not a member of the House Judiciary Committee to which this bill was assigned primary consideration, one of his cosponsors, Rep Correa (R,CA), is a member. This means that there may be sufficient influence to see the bill considered in that committee. Additionally, one cosponsor, Rep Titus (D,NV), is a member of the House Transportation and Infrastructure Committee to which this bill was assigned for secondary consideration. This means that there is similar possibility for consideration in that committee.

I suspect that there will be a tendency in the leadership of the Judiciary Committee to decide that the current authority under §124n for DHS should be sufficient to protect such venues with dedicated DHS oversight, absent any specific information about actionable intelligence about any widespread terrorist threat against such gatherings. This is due to the broad exemptions provided in the opening sentence of subsection (a) to a variety of federal statutes that would have to be violated to identify, track and/or take any action against unmanned aircraft systems (UAS). Until a workable way to modify those statutes to allow actions against unauthorized or unsafe UAS is developed, there is going to be continued reluctance to expand counter UAS (cUAS) authorities.

 

For more information about the provisions of this bill, including a commentary about the lack of a Homeland Security Committee referral, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/hr-3207-introduced-uas-counter-measures - subscription required.

Senate Passed S 1071 – FY 2026 NDAA

Yesterday, the last day of business in 2025, finished their consideration of S 1071, the FY 2026 National Defense Authorization Act (NDAA). The bill passed by a bipartisan vote of  77 to 20. While there had been concerns about some Republicans supporting the bill, in the final vote Democrats outnumbered GOP no votes 18 to 2. This evening the President signed the bill into law.

Review – 8 Advisories and 1 Update Published – 12-18-25

Today CISA’s NCCIC-ICS published eight control system security advisories for products from Axis Communications, Rockwell Automation, Advantech, Siemens, Mitsubishi Electric, National Instruments, Schneider Electric, and Inductive Automation. They also updated an advisory for products from Mitsubishi.

Advisories

Axis Advisory - This advisory describes four vulnerabilities in multiple Axis surveillance products.

Rockwell Advisory - This advisory describes two vulnerabilities in the Rockwell Micro8xx PLCs.

Advantech Advisory - This advisory describes five vulnerabilities in the Advantech WebAccess/SCADA product.

Siemens Advisory - This advisory describes an improper verification of source of a communications channel vulnerability in the Siemens Interniche IP-Stack used in a wide range of Siemens products.

NOTE: I briefly mentioned this vulnerability on December 14^th, 2025.

Mitsubishi Advisory - This advisory describes an OS command injection vulnerability in multiple Mitsubishi Electric Iconics Digital Solutions products.

NI Advisory - This advisory describes nine vulnerabilities in the NI LabView product.

Schneider Advisory - This advisory discusses a deserialization of untrusted data vulnerability in the Schneider EcoStruxure Foxboro DCS Advisor.

NOTE: I briefly discussed this vulnerability on December 14^th, 2025.

Inductive Advisory - This advisory describes an execution with unnecessary privileges vulnerability in the Inductive Ignition product.

Updates

Mitsubishi Update - This update provides additional information on the CNC Series advisory that was originally published on October 17^th, 2024, and most recently updated on March 18^th, 2025

 

For more information on these advisories, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/8-advisories-and-1-update-published-f72 - subscription required.

Short Takes – 12-18-25 – Federal Register Edition

Notice of Record of Decision for the Environmental Impact Statement for SpaceX Starship-Super Heavy at Cape Canaveral Space Force Station, Florida. Federal Register Dept of Air Force record of decision. Summary: “The DAF has decided to allow SpaceX to redevelop Space Launch Complex (SLC)-37 at CCSFS for Starship-Super Heavy launch and landing operations. Upon execution of the real property agreement and associated documentation, as analyzed in the Final EIS and while adhering to the mitigation measures identified, SpaceX is authorized to: (1) undertake construction activities necessary to redevelop SLC-37 and associated infrastructure for Starship-Super Heavy operations; (2) conduct prelaunch operations, including the transportation of launch vehicle components and static fire tests; and (3) conduct up to 76 launches and 152 landings annually, once a supplemental analysis of airspace impacts by the Federal Aviation Administration (FAA) is completed. The DAF will assess the airspace analysis conducted by the FAA and finalize a revised ROD prior to Starship-Super Heavy launches or landings occurring at CCSFS.”

Implementation of the Executive Order Entitled “Zero-Based Regulatory Budgeting To Unleash American Energy”; Partial Recission. Federal Register FERC direct final rule. Summary: “The Commission received a significant adverse comment on the amendment to insert a conditional sunset provision in 18 CFR 2.27 (Availability of North American Energy Standards Board (NAESB) Smart Grid Standards as non-mandatory guidance); therefore, the Commission is rescinding that amendment to 18 CFR 2.27.”

NASA Astronaut Candidate Selection (ASCAN) Qualifications Inquiry. Federal Register NASA 60-day ICR renewal notice. Summary: “This collection of information supports the National Aeronautics and Space Act of 1958, as amended, to create opportunities to improve processes associated with the evaluation and selection of individuals to participate in the NASA Astronaut Candidate Selection Program. The NASA Astronaut Selection Office (ASO) located at the Lyndon B. Johnson Space Center (JSC) in Houston, Texas is responsible for selecting astronauts for the various United States Space Exploration programs. In evaluating an applicant for the Astronaut Candidate Program, it is important that the ASO have the benefit of qualitative and quantitative information and recommendations from persons who have been directly associated with the applicant over the course of their career.” Comments due February 17^th, 2026.

EO 14367 - Designating Fentanyl as a Weapon of Mass Destruction. Federal Register.

CISA Adds Sonic Wall Vulnerability to KEV Catalog – 12-17-25

Yesterday CISA announced that it had added a missing authorization vulnerability in the SonicWall SMA CISA Adds Sonic Wall Vulnerability to KEV Catalog – 12-17-25. SonicWall issued their advisory on this vulnerability yesterday. They note that the vulnerability was reported by Clément Lecigne and Zander Work of Google Threat Intelligence Group. That advisory also reports that two other unpatched vulnerabilities are necessary for exploit of the missing authorization vulnerability by unauthorized actors. SonicWall has a new platform hotfix that mitigates this vulnerability.

CISA has required that all federal agencies utilizing this SonicWall product to apply “mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable”. The deadline for those actions is December 24^th, 2025.

CSB Provides Update on the Austin Powder Investigations – 12-17-25

This morning the Chemical Safety Board published an update on their investigation in to two NOx releases at Austin Powder facilities in Ohio and Tennessee. The update provides a brief description of both release incidents and outlines the ongoing work being done to determine the root cause of the releases.

CISA Adds FortiGuard Vulnerability to KEV Catalog – 12-16-25

Yesterday CISA announced that they had added an improper verification of cryptographic signature vulnerability in multiple FortiGuard products to their Known Exploited Vulnerabilities (KEV) catalog. FortiGuard previously disclosed the vulnerability along with mitigation measures and new versions that fixed the vulnerability. Three days later Arctic Wolf reported exploits of the vulnerability (along with a related improper verification vulnerability that is not yet been added to the KEV catalog) in the wild.

CISA had directed federal agencies using the affected FortiGuard products to apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. A deadline of December 23^rd, 2025 has been provided for those actions.

Review – Bills Introduced – 12-15-25

On Monday, with both the House and Senate in session, there were 44 bills introduced. This post is a day late because of a delay in publishing the listing of 25 of the 28 bills introduced in the House on December 15th. One of those bills may receive additional attention in this blog:

S 3481 A bill to expand the authority to use counter-unmanned aircraft system technologies to State, local, Tribal, and territorial law enforcement and correctional agencies, and for other purposes. Peters, Gary C. [Sen.-D-MI]

 

For more information on these bills, including legislative history for similar bills in the 118^th Congress, as well as a brief mention in passing about a national counterterrorism strategy for schools bill, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/bills-introduced-12-15-25 - subscription required.

Reader Comment – API & ASME CSB Responses

Yesterday William Sommer, MBA, PE left a comment on LinkedIn on my note about my blog post on the CSB’s video on the Yenkin-Majestic Resin Plant Vapor Cloud Explosion and Fire. He asked:

“I was struck by one of the recommendations for the API and ASME to provide design, construction, alteration guidance for low pressure vessels in flammable or highly hazardous chemical service: Does anyone know status and where to find?”

I have no insight into the status of the development of the design criteria within the American Petroleum Institute (API) and the American Society of Mechanical Engineers (ASME). I can, however, provide a little more information on the CSB’s take on the status of these recommendations; the data comes from the CSB’s Recommendations Statistics page and the September 23^rd, 2025, downloadable spread sheet on that page. Both recommendations were issued on November 30^th, 2023. The table below summarizes the pertinent data about the two recommendations.

 

 

The text of the API recommendation:

“Develop specific design, construction, and alteration guidance for low-pressure process vessels in flammable and other highly hazardous chemicals service not exceeding an internal pressure of 15 psig in API 510 Pressure Vessel Inspection Code, API RP 572 Inspection Practices for Pressure Vessels, and/or other appropriate products. At a minimum, include guidance for:  (i) determining and documenting the low-pressure vessel’s design pressure (such as through a data sheet and a nameplate affixed to the vessel); (ii) determining when or if all or parts of the ASME Boiler and Pressure Vessel Code should be applied; (iii) acceptable alternative engineering methods, if applicable; and, (iv) alteration requirements, such as design assessments, inspections, and pressure testing.”

The text of the supporting ASME recommendation:

“Assist API in developing design, construction, and alteration guidance for low-pressure vessels in flammable and other highly hazardous chemicals service not exceeding an internal pressure of 15 psig. If any new design and construction guidance is specifically developed for pressure vessels in flammable and other highly hazardous chemicals service not exceeding an internal pressure of 15 psig, reference the design and construction guidance in the Section VIII, Division 1 of the ASME Boiler and Pressure Vessel Code (BPVC).”

Even with a reasonable degree of consensus on the need for standards changes, it takes some time to develop, write and reach consensus on these sorts of things. It does seem to me that two years is not an unreasonable amount of time to be working on such a standard.

If anyone has any information on if/how progress is being made within API or ASME, please let me know.

Review – 4 Advisories and 3 Updates Published – 12-16-25

Today CISA’s NCCIC-ICS published four control system security advisories for products from Mitsubishi Electric, Hitachi Energy, Johnson Controls, and Güralp Systems. They also updated advisories for products from Fuji Electric, Johnson Controls, and Mitsubishi Electric.

Advisories

Mitsubishi Advisory - This advisory describes a cleartext storage of sensitive information vulnerability in the Mitsubishi GT Designer3 products.

Hitachi Energy Advisory - This advisory discusses the BlastRadius-Fail vulnerability.

NOTE: I briefly discussed this vulnerability on November 1^st, 2025.

Johnson Controls Advisory - This advisory describes four vulnerabilities in the Johnson Controls PowerG, IQPanel and IQHub products.

Güralp Advisory - This advisory describes an allocation of resources without limit or throttling vulnerability in the Güralp Fortimus, Minimus, and Certimus product series.

Updates

Fuji Update - This update provides additional information on the Fuji Monitouch V-SFT-6 advisory that was originally published on November 4^th, 2025.

Johnson Controls Update - This update provides additional information on the Johnson Controls iSTAR Ultra advisory that was originally published on August 12^th, 2025.

Mitsubishi Update - This update provides additional information on the Mitsubishi GENESIS advisory that was originally published on May 20^th, 2025, and most recently updated on August 28^th, 2025.

I briefly discussed this update on August 9^th, 2025.

For more information on these advisories, including a brief description of the CISA advisory format change, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/4-advisories-and-3-updates-published - subscription required.