Review – Public ICS Disclosures – Week of 1-31-26 – Part 2

For Part 2 we have four additional vendor disclosures from Sick (3) and Zyxel. There are seven vendor updates from Broadcom (3), ELECOM (2), HPE, and Moxa. Finally, we have an exploit for products from MySCADA.

Advisories

Sick Advisory #1 - Sick published an advisory that describes 15 vulnerabilities in their TDC-X401GL telematic data collector.

Sick Advisory #2 - Sick published an advisory that describes 12 vulnerabilities
(one with publicly available exploit) in their Incoming Goods Suite.

Sick Advisory #3 - Sick published an advisory that discusses an out-of-bounds read vulnerability in their nanoScan3 and microScan3 products.

Zyxel Advisory - Zyxel published an advisory that describes an OS command injection vulnerability in their ZLD firewalls.

Updates

Broadcom Update #1 - Broadcom published an update for their Brocade Fabric advisory that was originally published on January 27^th, 2026.

Broadcom Update #2 - Broadcom published an update for their Brocade Fabric OS advisory that was originally published on January 27^th, 2026.

Broadcom Update #3 - Broadcom published an update for their Brocade Fabric OS advisory that was originally published on January 27^th, 2026.

ELECOM Update #1 - JPCERT published an update for their ELECOM wireless LAN routers advisory that was originally published on August 27^th, 2024, and most recently updated on February 12^th, 2025.

ELECOM Update #2 - JPCERT published an update for their ELECOM wireless LAN routers advisory that was originally published on March 26^th, 2024, and most recently updated on November 26^th, 2024.

HPE Update - HPE published an update for their HPE ProLiant DL/ML/XD, Alletra, and Synergy Servers advisory that was originally published on December 12^th, 2025, and most recently updated on January 5^th, 2026.

Moxa Update - Moxa published an update for their Diffie-Hellman Key Exchange Protocol advisory that was originally published on June 2^nd, 2025, and most recently updated on January 5^th, 2026.

Exploits

MySCADA Exploit - Indoushka published an exploit for an OS command injection vulnerability in the MySCADA MyPRO Manager product.

Chemical Incident Reporting – Week of 1-31-26

NOTE: See here for series background.

Forest Park, GA  – 1-15-26

Local News Report: Here, here, and here.

There was a fire at a chemical manufacturing facility due to an upset condition in a reaction vessel. There was a brief evacuation order for the facility and shelter-in-place for the surrounding neighborhood. No injuries reported, no discussion about damages.

Not CSB reportable.

Skaneateles, NY– 1-21-26

Local News Report: Here, here, here, and here.

There was a minor chlorine leak at a water treatment plant in a pipe. The facility was evacuated pending closure of the valve leading to the area of the leak. No injuries were reported.

Not CSB reportable.

Washington County, PA – 1-30-26

Local News Report: Here, here, here, and here.

There was an explosion at a metal treating facility during chemical unloading operations. Five people were sent to the hospital; all have been released. There have been no discussions of damages at the facility. The last article reported that “magnesium-chloride” was unloaded into a tank containing hydrogen peroxide.

Probably not CSB reportable.

Russellville, AR – 2-4-26

Local News Report: Here, here, here, and here.

There was a truck rollover incident involving a tanker carrying ‘ammonia hydroxide’. Photo here. There was no chemical leak from the truck, but local businesses were evacuated as a precaution. Interestingly, the local fire departments Facebook site reports that the incident involved ‘anhydrous ammonia’ not ammonium hydroxide.

Not CSB reportable, this was a transportation related accident.

Short Takes – 2-7-26 – Federal Register Edition

Requests for Comments; Clearance of a Renewed Approval of Information Collection: Small Unmanned Aircraft Registration System; Correction. Federal Register FAA ICR correction notice. Summary: “On January 29, 2026, FAA published a notice and request for comments titled “Agency Information Collection Activities: Requests for Comments; Clearance of a Renewed Approval of Information Collection: Small Unmanned Aircraft Registration System”. That notice and request for comments incorrectly stated the docket number. This notice corrects the docket number.”

NHTSA Automated Vehicle Safety Public Meeting: March 2026. Federal Register NHTSA meeting notice. Summary: “The National Highway Traffic Safety Administration (NHTSA) will hold a public meeting on March 10, 2026. The event will provide updates and insights into ongoing vehicle automation activities across NHTSA. The meeting will be held in-person and will feature keynote addresses from the DOT leadership and industry executive panel discussions on key Automated Driving Systems (ADS) topics in the morning. The second portion of the meeting will build upon the ADS workshop held November 20, 2025. NHTSA gleaned valuable information from stakeholders on various topics. In this subsequent meeting, NHTSA intends to gather specific input on potential actions, including potential future guidance to the safe domestic development, testing and deployment of ADS equipped vehicles. NHTSA intends to utilize stakeholder input to better inform the agency's upcoming activities. The event will not be live streamed.”

Regulatory Issue Summary: Personnel Access Authorization Requirements for Non-Immigrant Foreign Nationals Working at Nuclear Power Plants. Federal Register NRC guidance notice. Summary: “The U.S. Nuclear Regulatory Commission (NRC) is issuing Regulatory Issue Summary (RIS) 2026-01, “Personnel Access Authorization Requirements For Non-Immigrant Foreign Nationals Working At Nuclear Power Plants,” to remind licensees of the NRC requirement that prior to granting or reinstating unescorted access (UA) or certifying unescorted access authorization (UAA) to non-immigrant foreign nationals for the purpose of performing work, licensees shall validate that the foreign national's claimed non immigration status is correct.”

Pipeline Safety: Request for Special Permit. Federal Register PHMSA special permit request. Summary: “The REX Pipeline was constructed under waiver Docket No. PHMSA-2006-23998 as an AMAOP pipeline before the AMAOP regulations under § 192.620 were promulgated. Another special permit under Docket No. PHMSA PHMSA-2022-0044 was later issued to allow for a waiver of class location change requirements under 49 CFR 192.611 for segments originally operated under the 2006 waiver; 49 CFR 192.620(c)(8) allows a Class 1 and Class 2 location to be upgraded one class due to class location changes. This special permit is proposed to supersede and replace both previous special permits to create a unified and consistent approach to pipeline safety, operations, and compliance by aligning the regulatory framework applicable to the REX Pipeline with existing Federal regulations.”

Review – Public ICS Disclosures – Week of 1-31-26 – Part 1

This week we have a moderately busy disclosure week. For Part 1 there nine are vendor disclosures from Cisco, Delta Electronics, Eaton, ELECOM (2), HP, Moxa (2), and Pilz.

Advisories

Cisco Advisory - Cisco published an advisory that describes a use of hard-coded credentials vulnerability in their Prime Infrastructure product.

Delta Advisory - Delta published an advisory that describes a stack-based buffer overflow vulnerability in their ASDA-Soft product.

Eaton Advisory - Eaton published an advisory that describes two improper certificate validation vulnerabilities in their Network Cards products.

ELECOM Advisory #1 - JPCERT published an advisory that describes five vulnerabilities in multiple ELECOM wireless LAN routers.

ELECOM Advisory #2 - JPCERT published an advisory that describes four vulnerabilities in multiple ELECOM wireless LAN products.

HP Advisory - HP published an advisory that discusses 287 vulnerabilities in their ThinPro products.

Moxa Advisory #1 - Moxa published an advisory that describes two vulnerabilities in the industrial computers.

Moxa Advisory #2 - Moxa published an advisory that describes a reliance on security through obscurity vulnerability in their Ethernet Switches.

Pilz Advisory - CERT-VDE published an advisory that discusses four vulnerabilities in the Pilz PIT User Authentication Service.

 

For more information on these disclosures, including links to 3^rd party advisories, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-1-844 - subscription required.

Review – Bills Introduced – 2-5-26

Yesterday with just the Senate in Washington, and the House meeting in pro forma session, there were 55 bills introduced. One of those bills will receive additional coverage in this blog:

HR 7390 SELF DRIVE Act of 2026 Latta, Robert E. [Rep.-R-OH-5]

 

For more information on these bills, including legislative history for similar bills in the 118^th Congress, as well as a mention-in-passing of a bill requiring a study of power transmission lines on highway and rail rights of way, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/bills-introduced-2-5-26 - subscription required.

Short Takes – 2-6-26 – Federal Register Edition

The Hazardous Waste Electronic Manifest System (“e-Manifest”) Advisory Board: Request for Nominations. Federal Register EPA notice. Summary: “The U.S. Environmental Protection Agency (EPA) invites the public to nominate experts in Information Technology (IT) to be considered for a three-year membership appointment to the Hazardous Waste Electronic Manifest System (“e-Manifest”) Advisory Board (the “Board”). Pursuant to the Hazardous Waste Electronic Manifest Establishment Act (the “e-Manifest Act” or the “Act”), EPA has established the Board to provide practical and independent advice, consultation, and recommendations to the EPA Administrator on the activities, functions, policies, and regulations associated with the Hazardous Waste Electronic Manifest (e-Manifest) System. In accordance with the e-Manifest Act, the EPA Administrator or designee will serve as Chair of the Board. This document solicits nominations for possible consideration of candidates to potentially fill a vacancy on the Board to serve as an IT expert for a three-year appointment. EPA may also consider nominations received through this solicitation to fill any unanticipated future vacancies on the Board for the following positions including an industry representative member with experience in using or representing users of the manifest system; and a state representative member responsible for processing manifests.” Nominations should be received by March 9^th, 2026.

Implementation of the Executive Order Entitled “Zero-Based Regulatory Budgeting To Unleash American Energy”; Correction. Federal Register DOE CFR correction amendment. Summary: “The Federal Energy Regulatory Commission (FERC) published a direct final rule [link added] in the Federal Register of October 21, 2025, revising its regulations to insert a conditional sunset date into certain regulations in response to Executive Order 14270, “Zero-Based Regulatory Budgeting to Unleash American Energy.” The document contained an error. This document corrects the regulations.” Note: This correction removes 18 CFR 157.202(2)(ii)(H), which was added here, but was not discussed in preamble.

EO 14381 - Celebrating American Greatness with American Motor Racing. Federal Register.

Review – 6 Advisories and 4 Updates Published – 2-5-26

Today CISA’s NCCIC-ICS published six control system security advisories for products from Hitachi Energy (2), Ilevia, 06 Automation, Mitsubishi, and TP-Link. They also updated advisories for products from KiloView, Multiple India-based Vendors, Hitachi Energy, and Mitsubishi.

Advisories

Hitachi Energy Advisory #1 - This advisory discusses the BlastRadius.Fail vulnerability in their FOX61x product.

NOTE: I briefly discussed the vulnerability on January 31^st, 2026.

Hitachi Energy Advisory #2 - This advisory discusses the BlastRadius.Fail vulnerability in their FOX61x product.

Ilevia Advisory - This advisory describes nine vulnerabilities (each with publicly available exploits) in the Ilevia EVE X1 Server.

06 Automation Advisory - This advisory describes an out-of-bounds write vulnerability in their Open62541 OPC UA stack.

Mitsubishi Advisory - This advisory describes an improper validation of specified quantity in input vulnerability in the MELSEC iQ-R Series products.

TP-Link Advisory - This advisory describes an improper authentication vulnerability in the TP-Link VIGI Series IP Cameras.

Updates

KiloView Update - This update provides additional information on the Encoder Series advisory that was originally published on January 29^th, 2025.

NOTE: The original advisory was a “has not responded to requests to work with CISA” advisory.

India Based Update - This update provides additional information on the CCTV Cameras advisory that was originally published on December 9^th, 2025.

NOTE: The original advisory was a “has not responded to requests to work with CISA” advisory.

Hitachi Energy Update - This update provides additional information on the Relion 670/650 advisory that was originally published on July 3^rd, 2025, and most recently updated on January 22^nd, 2026 (CISA advisory dates, not the Hitachi Energy dates listed in the ‘Revision History’).

NOTE: I briefly reported the updated information on February 1^st, 2026.

Mitsubishi Update - This update provides additional information on the MELSOFT Update Manager advisory that was originally published on July 3^rd, 2025, and most recently updated on January 20^th, 2026.

NOTE: CVE-2025-0411, listed as a third-party vulnerability in this advisory, was listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog today (listed on “February 6^th, 2026”?).

 

For more information on these advisories, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/6-advisories-and-4-updates-published - subscription required.

HR 5000 Adopted in Committee – Cybersecurity Hiring

Yesterday the House Oversight and Government Reform Committee held a markup hearing that considered 12 bills, including HR 5000, the Cybersecurity Hiring Modernization Act. An amendment in the form of a substitute was offered by Rep Comer (R,KY). That alternative language was approved by a vote of 44 to 0. The bill will now be cleared to move to the floor of the House, probably under the suspension of the rules process. Bipartisan support is expected.

The bill would limit the ability of federal agencies to require minimum educational requirements in the hiring of personnel to fill cybersecurity positions in the competitive service. No funding is authorized in this legislation.

The substitute language included a minor change in the proposed language to be added to 5 USC 3308. It added a new subparagraph (C) to the proposed §3308(b)(2), requiring the Office of Personnel Management to post regular updates to the Federal Cyber Workforce Dashboard maintained on the Office’s website.

With the bill being favorably reported by the Committee, it is now cleared for consideration by the full House; technically the Committee Report is supposed to be published first. I would expect the bill to be taken up under the suspension of the rules process; limited debate, no floor amendments, and a super majority required for passage. A similar bill,  HR 4502, the Modernizing the Acquisition of Cybersecurity Experts Act, passed in the 118^th Congress by a vote of 394 to 1.

CSB Releases Another Combustible Dust Safety Video

Yesterday the Chemical Safety Board (CSB) released a safety video outlining the causes and results of the May 2017 combustible dust explosions and fires at Di Didion Milling facility in Cambria, Wisconsin. As we have come to expect from CSB videos, the new video provides a compelling summary of the results of the CSB’s accident investigation and report.

There have been two earlier dust explosion videos from  the CSB. The first was the video about the explosions at Imperial Sugar. The second was a follow up video about the lack of action at OSHA about combustible dust hazards.

Review – Bills Introduced – 2-4-26

Yesterday, with both the House and Senate in Washington, there were 64 bills introduced. One of those bills may receive additional coverage in this blog:

HR 7384 To amend the Toxic Substances Control Act to prohibit the use of hydrogen fluoride (hydrofluoric acid) at petroleum refineries, and for other purposes. Waters, Maxine [Rep.-D-CA-43] 

Space Geek Legislation

I would like to mention one bill under my limited Space Geek coverage in this blog:

HR 7379 To amend title 51, United States Code, to provide the National Aeronautics and Space Administration authority to detect, identify, monitor, and track unmanned aircraft systems, and for other purposes. Stevens, Haley M. [Rep.-D-MI-11]

For more information on these bills, including legislative history for similar bills in the 118^th Congress, as well as a mention in passing of two bills limiting the use of facial recognition, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/bills-introduced-2-4-26 - subscription required.

DOT Publishes National Strategy for TDI RFI Notice

 Today, the DOT’s Office of the Assistant Secretary for Research and Technology (OST-R) published a request for information (RFI) in the Federal Register (91 FR 5150-5151) on “Request for Information-Research To Support Establishing a National Strategy for Transportation Digital Infrastructure”. This RFI is seeking public and stakeholder input on the research and development activities needed to modernize the nation's transportation system through the application of digital infrastructure at scale.

The RFI is looking for responses to questions in four key topic areas:

• Research, Development and Deployment,

• System Architecture, Interoperability and Standards,

• Artificial Intelligence and Automation, and

• Data Governance, Privacy, and Cybersecurity.

The last topic area includes two specific cybersecurity related questions:

The last topic area includes two specific cybersecurity related questions:

What data governance principles, access controls, and cybersecurity measures are needed to ensure trust, accountability, and privacy?

How should U.S. DOT apply the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) to TDI development and deployment?

In my opinion there should be an additional cybersecurity question added:

“Should DOT seek to establish a TDI related vulnerability disclosure process, or should it actively promote the use of CISA’s vulnerability reporting process.”

OST-R is soliciting public feedback. They request submissions be made in MS Word format and sent via email to DI-Strategy-RFI@dot.gov. Comments should be submitted by March 6^th, 2026

Review – Bills Introduced – 2-3-26

Yesterday, with both the House and Senate in Washington, there were 32 bills introduced. Two of those bills may receive additional coverage in this blog:

HR 7334 To establish a commission on robotics, and for other purposes. Obernolte, Jay [Rep.-R-CA-23]

HR 7338 To amend title 49, United States Code, to codify the Railroad Safety Advisory Committee, and for other purposes. Sykes, Emilia Strong [Rep.-D-OH-13]

 

For more information on these bills, including legislative history for similar bills in the 118^th Congress, as well as a mention in passing of a defense technology hub bill, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/bills-introduced-2-3-26 - subscription required.

OMB Approves OPM Civil Service Decline Final Rule

Yesterday the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had approved (with change) the final rule submitted by the Office of Personnel Management (OPM) on “Improving Performance, Accountability and Responsiveness in the Civil Service”. The notice of proposed rulemaking for this final rule was published on March 23^rd, 2025.

According to the Spring 2025 Unified Agenda entry for this rulemaking:

“OPM plans to finalize a rulemaking implementing E.O. 14171 [link added]. The proposed rule would create the procedures for moving policy-influencing positions into Schedule Policy/Career, which would increase career employee accountability. Schedule Policy/Career positions will remain career jobs filled on a nonpartisan basis. Yet they will be at-will positions excepted from adverse action procedures or appeals. This will allow agencies to quickly remove employees from critical positions who engage in misconduct, perform poorly, or obstruct the democratic process by intentionally subverting Presidential directives.”

The current civil service program was specifically designed to prevent federal jobs from being part of a political patronage system. While recognizing that above a certain level, management of the federal bureaucracy is political in nature (and thus requiring presidential appointment), most federal jobs require some level of practical expertise and experience to fairly and efficiently operate and oversee federal programs. Those jobs should not be subject to political litmus tests that change with every change in administration.

While I am sure that the folks at the Heritage Foundation have done an admirable job of cloaking their intent to rid the swamp of any liberal employees in language that would appear to be purely focused on efficiency and efficacy, the brief history of this administration makes it clear that ‘performance’ in the 47th Administration means fealty to, and adoration of, the royal executive. That makes this rulemaking suspect at best.

This rulemaking is outside of the typical scope of coverage of this blog, so I will probably not devote any significant coverage to it, but I will certainly mention its publication in the appropriate Short Takes post.

Short Takes – 2-3-26 – Federal Register Edition

Notice of Availability of the Final Environmental Impact Statement and Record of Decision for SpaceX Starship-Super Heavy Vehicle at Launch Complex 39A at Kennedy Space Center in Merritt Island, Florida. Federal Register FAA notice of availability. Summary: “In accordance with the National Environmental Policy Act of 1969, as amended (NEPA) and FAA Order 1050.1F, Environmental Impacts: Policies and Procedures, the FAA is announcing the availability of the Final Environmental Impact Statement (EIS) and Record of Decision (ROD) for SpaceX Starship-Super Heavy vehicle at Launch Complex 39A (LC-39A) at Kennedy Space Center (KSC) in Merritt Island, Florida (Final EIS and ROD).”

Notice of Rail Energy Transportation Advisory Committee Meeting. Federal Register STB meeting notice. Summary: “The purpose of this meeting is to facilitate discussions regarding issues including rail service, infrastructure planning and development, and effective coordination among suppliers, rail carriers, and users of energy resources. Potential agenda items for this meeting include a rail performance measures review, industry segment updates by RETAC members, and a roundtable discussion.” Meeting date: March 4^th, 2026.

Pipeline Safety: Request for Special Permit. Federal Register PHMSA special permit notice. Summary: “Due to Arctic-specific environmental and operational challenges associated with installing a fence along the boundary of the Facility, Harvest seeks to waive the requirements of 49 CFR 193.2905 and 193.2907, which require protective enclosures surrounding LNG facilities. The draft conditions were determined preliminarily to ensure that the special permit is consistent with pipeline safety for the Facility in Alaska's North Slope Borough.” Comments due March 5^th, 2026.

EO 14379 - Addressing Addiction Through the Great American Recovery Initiative. Federal Register.

EO 14380 – Addressing Threats to the United States by the Government of Cuba. Federal Register.

Review – 4 Advisories and 6 Updates Published – 2-3-26

Today CISA’s NCCIC-ICS published four control system security advisories for products from Synectix, RISS SRL, Avation, and Mitsubishi Electric. They also updated advisories for products from Ubia, Mitsubishi Electric, Schneider Electric, Rockwell Automation, and Hitachi Energy (2).

Advisories

Synectix Advisory - This advisory describes a missing authentication for critical function vulnerability in the Synectix AN 232 TRIO.

RISS Advisory - This advisory describes missing authentication for critical function vulnerability in the RISS SRL MOMA Seismic Station.

Avation Light Advisory - This advisory describes a missing authentication for critical function vulnerability in the Avation Light Engine Pro.

Mitsubishi Advisory - This advisory describes an incorrect default permissions vulnerability in the Mitsubishi FREQSHIP-mini for Windows.

Updates

Ubia Update - This update provides additional information on the Ubox advisory that was originally published on November 6^th, 2025. The new information includes updating affected products and mitigations.

NOTE: The original was a “did not respond to CISA’s attempts to coordinate” advisory.

Mitsubishi Update - This update provides additional information on the Multiple FA Products that was originally published on May 8^th, 2025.

Schneider Update - This update provides additional information on the RemoteConnect advisory that was originally published on January 23^rd, 2025, and most recently updated on May 20^th, 2025.

Rockwell Update - This update provides additional information on the Arena advisory that was originally published on December 10^th, 2024 and most recently updated on January 9^th, 2025.

NOTE: I briefly discussed these two new Arena vulnerabilities on July 13^th, 2025.

Hitachi Energy Update #1 - This update provides additional information on the EC 61850 MMS-Server advisory that was originally published on March 30^th, 2023, and most recently updated on June 5^th, 2025.

I briefly discussed the updated information on February 1^st, 2026.

Hitachi Energy Update #2 - This update provides additional information on the Relion 670 advisory that was originally published on March 9^th, 2023, and most recently updated on June 4^th, 2025.

I briefly discussed the updated information on February 1^st, 2026.

 

For more information on these advisories, including continuing commentary on misleading ‘revision date’ information, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/4-advisories-and-6-updates-published - subscription required.

House Concurs in Senate Amendment to HR 7148

Earlier this afternoon, the House took up the Senate Amendment to HR 7148, that removed Division H, DHS spending, from HR 7148 and provided a two-week continuing resolution for that sole remaining unapproved FY 2026 spending bill. At 11:42 am EST the House began their vote of H Res 1032, the rule for the consideration of the Senate Amendment to HR 7148. That resolution was approved by a near party-line vote of 212 to 210; Rep Rose (R,TN) voted Nay and five representatives from each party did not vote. After a one-hour debate the House concurred in the amendment by a more complex vote of 217 to 214; 21 members from each party crossed party line and only Rep Crenshaw (R,TX).

HR 7148 goes to the President who is expected to sign it tonight, with the government being fully re-opened tomorrow. The two appropriations committees will start working in earnest on negotiating a version of the DHS spending bill that will have some sort of chance of passing in both houses. That bill will have to be passed by February 13^th, 2026 or DHS will face another shutdown.

Short Takes – 2-3-26 – Space Geek Edition

Here’s why Blue Origin just ended its suborbital space tourism program. ArsTechnica.com commentary. Pull quote: “The decision to end New Shepard will inconvenience a few dozen very rich people waiting their turn to go into space on New Shepard, but more broadly, it is a win for the US space industry. Blue Origin has justifiably been criticized for trying to do too many things at once, resulting in all of its programs moving too slowly. Focusing on New Glenn and the lunar lander program in the near term will be a great boon for space access and the nation’s competition with China to secure the Moon.”

NASA Selects Axiom Space for Fifth Private Astronaut Mission to International Space Station. AxiomSpace.com article. Pull quote: ““Voyager’s role on Ax-5 reflects a proven mission-management heritage built through years of supporting commercial payloads on the space station,” said Dylan Taylor, chairman & CEO, Voyager Technologies. “We are proud to partner with Axiom Space in support of the Ax-5 mission. As commercial LEO destinations mature into sustained operational domains, missions like Ax-5 will further demonstrate the power of end-to-end execution across human spaceflight, research payloads, and the commercial infrastructure shaping the future space economy.””

SpaceX files plans for million-satellite orbital data center constellation. SpaceNews.com article. Pull quote: “Much of the filing emphasizes the advantages of orbital data centers, a concept being explored by both established companies and startups. SpaceX argues that rising costs and power demands of terrestrial data centers, combined with falling launch costs, could make space-based computing more economical in the coming years.”

GAO flags risks in Space Development Agency’s missile-tracking satellite program. SpaceNews.com article. Pull quote: “GAO issued six recommendations, including urging SDA to conduct more rigorous assessments of technology readiness, develop an architecture-level schedule, improve collaboration with warfighters, and require more complete cost data from contractors. The Department of Defense concurred with most of the recommendations but only partially agreed with one.” Report link.

Space Command’s case for orbital logistics: Why the Pentagon is being urged to think beyond launch. SpaceNews.com article. Pull quote: “Speaking Jan. 28 at the SpaceCom Space Mobility conference, Whiting, commander of U.S. Space Command, laid out a detailed case for building a space transportation and logistics infrastructure that would allow U.S. satellites to maneuver, be repaired, refueled and sustained in orbit — much as U.S. forces on land, sea and in the air depend on vast logistics networks to operate and fight.”

NASA considering alternatives for Gateway logistics. SpaceNews.com article. Pull quote: “Work on Gateway logistics paused last year following the administration’s fiscal year 2026 budget proposal, which sought to cancel the Gateway. Congress, however, funded the program in the budget reconciliation bill passed last July.”

China eyes space resources, space tourism and on-orbit digital infrastructure. SpaceNews.com article. Pull quote: “Regarding space-based digital infrastructure, CASC proposes gigawatt-scale space-based computing infrastructure, envisioning integrated cloud-edge-terminal architecture in orbit. Concepts include space data processed in space and joint space-ground computing. This aligns with Chinese interests in reducing reliance on downlink bandwidth, autonomous satellite operations and space-based AI and data processing, as demonstrated by experimental satellites and push to develop capabilities including optical inter-satellite links.”

U.S. Space Command to bring commercial firms into classified wargame on nuclear threats in space. SpaceNews.com article. Pull quote: “Analysts note that the treaty’s [1967 Outer Space Treaty] prohibition is narrower than it sometimes appears. It does not ban all weapons in space. Anti-satellite weapons, electronic warfare, cyber operations and other counterspace capabilities fall outside the WMD ban and have been developed for years under national military doctrines.”

Backlog List

• Toxicology and Environmental Chemistry,

• Earth would have 3 days to avoid satellite catastrophe from solar storm,

• Why U.S. and Chinese satellites are ‘dogfighting’ in orbit,

• Congress’ SBIR standoff is slowing Space Force innovation — it must act now,

• Starlink Satellite Malfunctions, Ejects Debris Fragments,

• Germany awards $1.9 billion SAR satellite deal to Rheinmetall-Iceye venture,

• Trump signs sweeping executive order to assert U.S. dominance in space,

• Fact Sheet: President Donald J. Trump Launches a New Age of American Space Achievement,

• China plans 2026 debut of new rocket for crewed lunar and LEO missions, and

• ESA weighing options to address exploration funding shortfall.

Review – Bills Introduced – 2-2-26

Yesterday, with both the House and Senate in Washington, there were 30 bills introduced. One of those bills may receive additional coverage in this blog:

HR 7305 To amend the Infrastructure Investment and Jobs Act to reauthorize the Department of Energy's Energy Sector Operational Support for Cyberresilience Program to provide operational support for energy sector cybersecurity and resilience. Castor, Kathy [Rep.-D-FL-14]

 

For more information on these bills, including legislative history for similar bills in the 118^th Congress, as well as a mention in passing of a bill to require cybersecurity regulations in the SNAP program, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/bills-introduced-2-2-26  - subscription required.

Rule for HR 7148 Senate Amendment – Consolidated Appropriations

 This evening the House Rules Committee held a rule hearing for three bills that ill be considered under a rule, that includes the Senate Amendment to HR 7148 that removes the DHS spending portion of the bill and substitutes continuing resolution language for that Division. The Committee approved a closed rule to concur with the Senate Amendment by a party-line vote of 8 to 4. This means that there will be just one hour of debate on the Amendment, no amendments to be offered, and a single vote on passage.

A large portion of the federal government remains under shutdown since Friday midnight because the Senate amended the last minibus spending bill on Friday, the last day of the latest continuing resolution. If the House concurs with the Senate Amendment tomorrow, as is mostly expected, the completed bill goes to the President for signature. There remains a chance that the bill will fail in House tomorrow; House Democrats are not expected to vote for the Senate Amendment as an expression of their concerns about recent lethal immigration enforcement activities by ICE and CBP. If more than two Republicans also vote Nay on the bill because of underlying spending issues, then the bill would fail. Of course, each Democrat that did vote in favor of the Senate Amendment would provide legislative cover for an additional Republican to vote their fiscal concerns.

The House is expected to vote on the rule at about 11:30 am EST. If the rule passes a vote on the Senate Amendment is expected at about 1:00 pm EST.

Review – Committee Hearings – Week of 2-1-26

 This week both the House and Senate will be in Washington. There is a moderately busy hearing schedule, including a spending bill rule hearing and a FERC oversight hearing in the House. In the Senate there will be a space geek markup hearing and a water cybersecurity hearing.

Rule Hearing

This afternoon the Houe Rules Committee will hold a rule hearing to consider five pieces of legislation, including the Senate amended version of HR 7148, the Consolidated Appropriations Act. The amendment adopted by the Senate on Friday deleted Division H (effectively HR 7147, the DHS spending bill),  of the bill passed in the House and added continuing resolution language. That language would continue DHS funding at current rates (still including chemical security spending) through February 13^th, 2026.

FERC Oversight

On Tuesday the Subcommittee on Energy of the House Energy and Commerce Committee will hold a hearing on “Oversight of FERC: Advancing Affordable and Reliable Energy for All Americans”. The witness list includes the five FERC Commissioners.

Markup Hearings

On Tuesday the Senate Commerce, Science and Technology Committee will hold a business meeting. It will include marking-up S 1848, the Orbital Sustainability (ORBITS) Act of 2025.

Water Cybersecurity

On Wednesday the Senate Environment and Public Works Committee will hold a hearing on “Identifying and Addressing Cybersecurity Challenges to Protect America’s Water Infrastructure”.

 

For more information on these hearings, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/committee-hearings-week-of-2-1-26 - subscription required.

Review – Public ICS Disclosures – Week of 1-24-26 – Part 2

For Part 2 we have six additional vendor disclosures from dormakaba (3), Splunk, and WatchGuard (2). We have bulk vendor updates from Broadcom (7). There are six additional vendor updates from HP, HPE (3), Palo Alto Networks, and VMware. We also have a researcher report on vulnerabilities in products from IDIS. Finally, we have an exploit for products from Advantech.

Advisories

Dormakaba Advisory #1 - Dormakaba published an advisory that describes 12 vulnerabilities in their Access Manager product.

Dormakaba Advisory #2 - Dormakaba published an advisory that describes seven vulnerabilities in their Kaba exos 9300 systems.

Dormakaba Advisory #3 - Dormakaba published an advisory that describes a debug messages revealing unnecessary information vulnerability in their registration Unit 9002 Generation K5.

Splunk Advisory - Splunk published an advisory that discusses an improper handling of length parameter inconsistency vulnerability (with publicly available exploits, listed in CISA’s KEV catalog) in their Enterprise product.

WatchGuard Advisory #1 - WatchGuard published an advisory that discusses a privilege escalation vulnerability in their Mobile VPN with IPSec client for Windows.

WatchGuard Advisory #2 - WatchGuard published an advisory that describes an LDAP injection vulnerability in their Fireware OS product.

Bulk Vendor Updates – Broadcom

• Brocade Fabric OS (10.x and 9.2.x Releases) Vulnerability Disclosures,

• OS command injection vulnerability in OpenSSH (CVE-2023-51385),

• Brocade ASCG Vulnerability Disclosures,

• Brocade SANnav Vulnerability Disclosures,

• CVE-2023-31928 - XSS vulnerability in Brocade Webtools,

• Potential Denial of Service exploit in Net-SNMP 5.8 through 5.9.3, and

• Linux Kernel Vulnerable to Dangling Pointer via Garbage Collector Racing Against Connect() in AF_UNIX Module.

Bulk Vendor Updates – Hitachi Energy

• Cybersecurity Advisory - Reboot Vulnerability in Hitachi Energy Relion 670/650 and SAM600-IO series products,

• Cybersecurity Advisory - Improper Input Validation Vulnerability in Hitachi Energy’s Relion® 670/650/SAM600-IO series Product,

• Cybersecurity Advisory - OpenSSL Vulnerabilities in Hitachi Energy’s Relion® 670, 650, SAM600-IO series Product,

• Cybersecurity Advisory - Update package validation Vulnerability in Hitachi Energy’s Relion® 670, 650 and SAM600-IO Series Products, and

• Cybersecurity Advisory - IEC 61850 MMS-Server Vulnerability in Hitachi Energy’s Relion® 670, 650 series and SAM600-IO Products.

Updates

HP Update - HP published an update for their Intel Ethernet I219 Software advisory that was originally published on February 11^th, 2025, and most recently updated on April 24^th, 2025.

HPE Update #1 - HPE published an update for their OneView Software advisory that was originally published on December 17^th, 2025, and most recently updated on December 26^th, 2025.

HPE Update #2 - HPE published an update for their Aruba Networking Virtual Intranet Access advisory that was originally published on January 13^th, 2026.

HPE Update #3 - HPE published an update for their Aruba Networking AOS-8 advisory that was originally published on January 13^th, 2026.

Palo Alto Networks Update - PAN published an update for their GlobalProtect Gateway and Portal advisory that was originally published on January 14^th, 2026, and most recently updated on January 16^th, 2026.

VMware Update - Broadcom published an update for the VMware vCenter Server advisory that was originally published on June 17^th, 2024.

Researcher Reports

IDIS Report - Claroty published a report that describes an argument injection vulnerability in the IDIS ICM Viewer.

Exploits

Advantech Exploit - Indoushka published an exploit for an SQL Injection vulnerability in the Advantech IoTSuite and IoT Edge products.

 

For more information about these disclosures, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-1-2c5 - subscription required.

Short Takes – 1-31-26 – Federal Register Edition

Hazardous Materials: Request for Feedback on Hazmat Transportation Risks: Heavy-Duty Electric Vehicles Versus Internal Combustion Engine Motor Carriers. Federal Register PHMSA request for information. Summary: “The Pipeline and Hazardous Materials Safety Administration (PHMSA) seeks public input on the safety risks, operational challenges, and regulatory considerations associated with transporting hazardous materials (hazmat) using heavy-duty electric vehicles (EVs) compared to internal combustion engine (ICE) motor carriers (i.e., gas or diesel). PHMSA aims to understand what impact the transition from ICE to EV motor carriers may have on hazmat packaging integrity, transportation safety, emergency response protocols, regulatory compliance, and overall vehicle risk. PHMSA may use the information gathered to develop a statement of work for further research into the safety of transporting hazardous materials in EVs.”

Categorical Exclusion for Advanced Nuclear Reactors. Federal Register DOE categorical exception notice. Summary: “The U.S. Department of Energy (DOE or the Department) is establishing a categorical exclusion for authorization, siting, construction, operation, reauthorization, and decommissioning of advanced nuclear reactors for inclusion in its National Environmental Policy Act (NEPA) implementing procedures. DOE is including the categorical exclusion in the component of its NEPA implementing procedures that it maintains outside of the Code of Federal Regulations. The new categorical exclusion is based on the experience of DOE and other Federal agencies, current technologies, regulatory requirements, and accepted industry practice.”

Best Practices Webinar Series Presented by the National Center of Excellence for Liquefied Natural Gas Safety. Federal Register PHMSA webinar notice. Summary: “The National Center of Excellence for Liquefied Natural Gas Safety (National LNG Center) will host a series of informational webinars on best practices for LNG safety, titled “Prioritizing Safety: Best Practices in LNG.” The webinars are free, will be hosted virtually, and will require advance registration. The series will be held monthly using Zoom. Each webinar will be one hour in length and will be recorded. The National LNG Center will provide electronic access to all materials, including recordings, transcripts, and presentations, after conclusion of each webinar. The webinars will cover a different best practice each session.”

Clearance of Renewed Approval of Information Collection: Small Unmanned Aircraft Registration System. Federal Register FAA 30-day ICR renewal notice. Summary: “In accordance with the Paperwork Reduction Act of 1995, FAA invites public comments about our intention to request the Office of Management and Budget (OMB) approval to renew an information collection. The Federal Register Notice with a 60-day comment period soliciting comments on the following collection of information was published on September 23, 2025. The collection involves inputting minimal information into a database to register small, unmanned aircraft. Aircraft registration is necessary to ensure personal accountability among all users of the National Airspace System (NAS). Aircraft registration also allows the FAA and law enforcement agencies to address non-compliance by providing the means for identifying an aircraft's owner and operator. This collection also permits individuals to de-register or update their record in the registration database.”

EO 14377 - Addressing State and Local Failures to Rebuild Los Angeles After Wildfire Disasters. Federal Register.

EO 14378 - Continuance of the Federal Emergency Management Agency Review Council. Federal Register.

PHMSA Publishes 60-day Renewal Notice for 7 Hazmat ICRs

Yesterday DOT’s Pipeline and Hazardous Material Safety Administration (PHMSA) published a 60-day information collection request (ICR) renewal notice in the Federal Register (91 FR 4172-4178) for seven hazardous materials ICRs. According to the notice: “PHMSA has revised burden estimates, where appropriate, to reflect current reporting levels or adjustments based on changes in proposed or final rules published since the information collections were last approved.”

The seven ICRs include:

Inspection and Testing of Portable Tanks and Intermediate Bulk Containers (2137-0018),

Hazardous Materials Incident Reports (2137-0039),

Rail Carrier and Tank Car Tanks Requirements, Rail Tank Car Tanks—Transportation of Hazardous Materials by Rail (2137-0559),

Testing Requirements for Non-Bulk Packaging (2137-0572),

Hazardous Materials Public Sector Training and Planning Grants (2137-0586),

Cargo Tank Motor Vehicles in Liquefied Compressed Gas Service (2137-0595), and

Inspection and Testing of Meter Provers (2137-0620).

NOTE: The first link for each ICR is for the description of the collection in yesterday’s notice. The last link is to the currently approved ICR record.

The table below shows the burden estimate for both this renewal notice and the currently approved ICR.

 

There is no explanation for the large change in the burden estimates for 2137-0559 in yesterday’s notice. Comparing the detailed burden information in the notice with the Supporting Document that PHMSA provided to OIRA for the current ICR, there are six information collections missing from the notice:

• Hazardous Materials Train Consist Additional Information (Class I, II, III Railroads) - Section 174.26 (131,042 responses and 10,876 hrs),

• Notification of Hazardous Materials Accidents or Incidents - Class I, II, II Railroad - Section 174.26 (491 responses and 122.75 hrs),

• Creation of Test Records for Emergency System Notification Test (Class I, II, III) – Section (658 responses and 1438 hrs),

• Retention of Test Records for Emergency System Notification Test – Section 174.28(b) (758 responses and 63 hrs),

• Creation of Class III alternative emergency response information plan – Section (388 responses and 1,552 hrs), and

• Retention of Class III alternative emergency response information plan (Retention Only) – Section (388 responses and 32 hrs).

These may have been moved to new ICR. We will be able to tell for sure when PHMSA submits the renewal request to OIRA after the 30-day ICR notice is published.

PHMSA is soliciting public comments on this ICR renewal. Comments may be submitted via the Federal eRulemaking Portal (www.Regulations.gov; Docket #PHMSA-2026-0199). Comments should be submitted by March 31^st, 2026.

Review – Bills Introduced – 1-30-26

Yesterday, with just the Senate in Washington and the House meeting in pro forma session, there were 43 bills introduced. Two of the bills may receive additional coverage in this blog:

HR 7285 To amend the Homeland Security Act of 2002 to authorize the use of certain financial assistance for vehicle security enhancement upgrades, and for other purposes. Gonzales, Tony [Rep.-R-TX-23] 

HR 7294 To study the impacts of artificial intelligence technology with respect to the security of telecommunications networks, and for other purposes. Menendez, Robert [Rep.-D-NJ-8] 

Space Geek Legislation

I would like to mention one bill under my limited Space Geek coverage in this blog:

HR 7273 NASA Reauthorization Act of 2026.  Babin, Brian [Rep.-R-TX-36]

 

For more information on these bills, including legislative history for similar bills in the 118^th Congress, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/bills-introduced-1-30-26 - subscription required.

Review – Public ICS Disclosures – Week of 1-24-26 – Part 1

This is a moderately busy disclosure week. We have bulk vendor disclosures from Broadcom (48). There are also 14 other vendor disclosures from B&R (2), Beckhoff (2), Dell, Dassault Systems (2), Hanwha Vision, Hitachi, Hitachi Energy (3), HPE, and Siemens.

Bulk Vendor Disclosures – Broadcom

• Nessus detected vulnerability in the Brocade OVA base image (CVE-2025-21991),

• The DisableForwarding directive does not fully adhere to the intended functionality as documented (CVE-2025-32728),

• Vixie Cron before the 3.0pl1-133 Debian package allows local users to cause a denial of service,

• Curl vulnerabilities detected in SANnav images (CVE-2025-4947, CVE-2025-5025) ,

• DoS due to improper input validation vulnerability in Apache Tomcat - CVE-2024-24549,

• Spring Framework DoS (CVE-2024-38808, CVE-2024-38809 and CVE-2024-22262),

• Oracle Java SE Updates (July 2025),

• Multiple Vulnerabilities in Node.js (Wednesday, May 14, 2025 Security Releases). Nessus Plugin ID 236766,

• Low-level invalid GF(2^m) parameters lead to OOB memory access,

• Multiple Vulnerabilities in Apache Kafka,

• Postgres vulnerabilities (CVE-2025-8713, CVE-2025-8714, CVE-2025-8715),

• libcurl's ASN1 parser code has the GTime2str() function, used for parsing an ASN.1 (CVE-2024-7264) ,

• PostgreSQL GB18030 encoding validation can read one byte past end of allocation for text that fails validation,

• Vulnerability in OpenSSH when the VerifyHostKeyDNS option is enabled (CVE-2025-26465),

• Rocky Linux Updates applied to SANnav (CVE-2024-3661, CVE-2024-11187, CVE-2024-12797) ,

• A malicious rsh server can overwrite arbitrary files in a directory on the rcp client machine,

• xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak,

• Multiple Linux Security Updates applied to Brocade Fabric OS 10.0,

• The x509 application adds trusted use instead of rejected use,

• libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time,

• MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64,

• In elfutils 0.183, an infinite loop was found in the function handle_symtab in readelf.c,

• Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses,

• GNU tar mishandled extension attributes in a PAX archive,

• This flaw allows a malicious HTTP server to set "super cookies" in curl,

• Glib GVariant deserialization fails to validate input,

• A heap out-of-bounds read flaw was found in builtin.c in the gawk package,

• Scan discovered multiple CVEs against glibc,

• Null pointer dereference found in openldap,

• A denial of service vulnerability exists in curl,

• An allocation of resources without limits or throttling vulnerability exists in curl <v7.88.0,

use-after-free and memory corruption,

• A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and "telnet options" during server negotiation,

• The allocate_structures function insufficiently checks bounds before arithmetic multiplication,

• Linux kernel's block_invalidatepage in fs/buffer.c in the filesystem,

• Brocade SANnav DataBase password in plain text is logged in failover logs (CVE-2025-12680),

• Plaintext Switch admin login password is seen in Brocade SANnav support save (CVE-2025-12772) ,

• Plain password is logged in the audit logs while executing update-reports-purge-settings.sh script with Brocade SANnav before 2.4.0a (CVE-2025-12773),

• SQL queries with sensitive information printed in logs with Brocade SANnav before 3.0 (CVE-2025-12774),

• Information disclosure in Brocade Fabric OS before 9.2.1c2, 9.2.2 through 9.2.2a and 10.0.0 (CVE-2026-0383),

• Privilege escalation in Brocade Fabric OS before 9.2.1c3, and 9.2.2 though 9.2.2b (CVE-2025-9711),

• Directory transversal vulnerability in Brocade Fabric OS before 9.2.1 using grep command (CVE-2025-58380),

• Plain text pbe key visible in audit log during Brocade SANnav migration from 2.4.0a to 3.0.0 (CVE-2025-12679),

• Directory transversal vulnerability in Brocade Fabric OS before 9.2.1c2 and 9.2.2 through 9.2.2a using various shell commands (CVE-2025-58381),

• Password Exposure in Brocade Fabric OS before 9.2.1 (CVE-2025-58379),

• Privilege escalation in Brocade Fabric before 9.2.1c2 and 9.2.2 through 9.2.2a (CVE-2025-58382),

• Privilege escalation via bind command in Brocade Fabric OS (CVE-2025-58383),

• Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf (CVE-2025-12543).

Advisories

B&R Advisory #1 - B&R published an advisory that discusses the PixieFail vulnerabilities.

B&R Advisory #2 - B&R published an advisory that describes an insertion of sensitive information into log file vulnerability.

Beckhoff Advisory #1 - CERT-VDE published an advisory that describes three vulnerabilities in the Beckhoff Device Manager.

Beckhoff Advisory #2 - CERT-VDE published an advisory that describes a cross-site scripting vulnerability in the Beckhoff TwinCAT 3 HMI Server.

Dell Advisory - Dell published an advisory that discusses an improper handling of length parameter inconsistency vulnerability (with publicly available exploits) in their Wyse Management Suite.

Dassault Advisory #1 - Dassault published an advisory that describes a heap-based buffer overflow vulnerability in SOLIDWORKS eDrawings.

Dassault Advisory #2 - Dassault published an advisory that describes an out-of-bounds write vulnerability in their SOLIDWORKS eDrawings.

Hanwha Advisory - Hanwha published an advisory that describes five vulnerabilities in multiple Wisenet cameras from Hanwha.

Hitachi Advisory - Hitachi published an advisory that discusses to allocation of  resources without limit or throttling vulnerabilities in their Cosminexus Component Container.

Hitachi Energy Advisory #1 - Hitachi Energy published an advisory that discusses the BlastRadius-Fail vulnerability in their FOX61x products.

Hitachi Energy Advisory #2 - Hitachi Energy published an advisory that discusses the BlastRadius-Fail vulnerability in their XMC20 products.

Hitachi Energy Advisory #3 - Hitachi Energy published an advisory that describes the use of default credentials vulnerability in their SuprOS products.

HPE Advisory - HPE published an advisory that describes three vulnerabilities in their Aruba Fabric Composer product.

Siemens Advisory - Siemens published an advisory that discusses 51 vulnerabilities in their SINEC OS based products.

 

For more information on these disclosures, including links to 3^rd party advisories, researcher reports, and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-1-2c6 - subscription required.