OMB Approves EPA PFAS TSCA Reporting NPRM

Yesterday the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had approved a notice of proposed rulemaking (NPRM) from the EPA on “Perfluoroalkyl and Polyfluoroalkyl Substances (PFAS) Data Reporting and Recordkeeping under the Toxic Substances Control Act (TSCA); Revision to Regulation”. The NPRM was sent to OMB on August 29^th, 2025.

According to the entry for this rulemaking in the Spring 2025 Unified Agenda:

“The Environmental Protection Agency (EPA or Agency) is considering a proposed rule to amendments to the Toxic Substances Control Act (TSCA) regulation for reporting and recordkeeping requirements for perfluoroalkyl and polyfluoroalkyl substances (PFAS). As promulgated in October 2023, the regulation requires manufacturers (including importers) of PFAS in any year between 2011-2022 to report certain data to EPA related to exposure and environmental and health effects. EPA plans to propose the incorporation of certain exemptions and other modifications to the scope of the reporting rule.”                      

Generally, I do not cover TSCA rulemakings in any detail in this blog, and I do not expect this to be an exception to that rule. I will, at least, mention publication of this rule in the appropriate ‘Short Takes’ post.

Review – Public ICS Disclosures – Week of 10-18-25

This week we have bulk vendor disclosures from Moxa (6). There are eight additional vendor disclosures from ABB, Belden, HP (3), Pilz, Sauter, and Zyxel. We also have three vendor updates from ABB (2) and HP.

Bulk Disclosures

Bulk Advisories – Moxa

• CVE-2025-1679, CVE-2025-1680: Stored Cross-site Scripting (XSS) and Host Header Injection Vulnerabilities in Ethernet Switch,

• Security Enhancement: Modbus/TCP Discrete Input Access,

• Security Enhancement: Modbus/TCP Device Identification,

• Security Enhancement: SNMP Agent Default Community Name (public),

• Security Enhancement: SSH Weak MAC Algorithms Enabled, and

• Security Enhancement: SSH Weak Key Exchange Algorithms Enabled.

Advisories

ABB Advisory - ABB published an advisory that describes a heap-based buffer overflow vulnerability in their Terra AC wallbox.

Belden Advisory - Belden published an advisory that discusses the Blast-RADIUS vulnerability. Belden

HP Advisory #1 - HP published an advisory that discusses an out-of-bounds read vulnerability in multiple notebook and desktop PCs.

HP Advisory #2 - HP published an advisory that discusses two vulnerabilities in multiple notebook and desktop PCs.

HP Advisory #3 - HP published an advisory that discusses an out-of-bounds write vulnerability in multiple notebook PCs.

Pilz Advisory - CERT-VDE published an advisory that discusses an integer overflow or wraparound vulnerability (with publicly available exploits) in the Pilz PASvisu Runtime product.

Sauter Advisory - CERT-VDE published an advisory that describes six vulnerabilities in the Sauter modulo 6 devices.

Zyxel Advisory - Zyxel published an advisory that describes two vulnerabilities in their ZLD firewalls.

Updates

ABB Update #1 - ABB published an update that provides additional information on the ALS-mini-S4/S8 IP advisory that was originally published on October 20^th, 2025.

ABB Update #2 - ABB published an update that provides additional information on the CoreSense advisory that was originally published on April 16^th, 2025, and most recently updated on October 10^th, 2025.

HP Update - HP published an update that provides additional information on their AMD Transient Scheduler advisory that was originally published on July 10^th, 2025, and most recently updated on August 15^th, 2025.

 

For more information on these disclosures, including links to 3^rd party advisories, researcher reports, and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-10-174 - subscription required.

Review - HR 5078 Introduced – PILLAR Act

Last month Rep Ogles (R,TN) introduced HR 5078, the Protecting Information by Local Leaders for Agency Resilience (PILLAR) Act. The bill would reauthorize CISA’s State and local cybersecurity grant program through 2035 (the program terminated on September 30^th, 2025), including updating 6 USC 665g. Changes include clarifying that the grant program could be used to support operational technology, as well as information systems. There is no specific funding provided in this reauthorization, instead the funding would be “subject to the availability of appropriations”.

Markup Hearing

On September 9^th, 2025, the House Homeland Security Committee held a business meeting that considered seven bills, including HR 5078. The bill was ordered reported favorably by a strongly bipartisan vote of 21 to 1. The Committee Report has not yet been published.

Moving Forward

The bipartisan support in Committee almost guarantees that the bill will be considered in the full House under the suspension of the rules process. While this process restricts debate, prohibits floor amendments, and requires a supermajority for passage, it also increases the chance that the bill will be considered; more bills are considered under the suspension process than are considered under regular order.

 

For more information about the provisions of this bill, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/hr-5078-introduced-pillar-act - subscription required.

Transportation Chemical Incidents – Week of 9-20-25

Reporting Background

See this post for explanation, with the most recent update here (removed from paywall).

Data from PHMSA’s online database of transportation related chemical incidents that have been reported to the agency.

Incidents Summary

• Number of incidents – 590 (547 highway, 37 air, 6 rail, 0 water)

• Serious incidents – 3 (3 Bulk release, 0 evacuation, 0 injury, 0 death, 1 major artery closed, 1 fire/explosion, 40 no release)

• Largest container involved – 30,400-gal DOT 117J100W Railcar {Alcohols, N.O.S.} Gaskets deteriorated due to fire adjacent to railcar.

• Largest amount spilled – 400-gal DOT 117J100W Railcar {Alcohols, N.O.S.} Gaskets deteriorated due to fire adjacent to railcar. NOTE: Different railcar same incident.

• Total amount reported spilled in all incidents – 2401.2-gal

NOTE: Links above are to Form 5800.1 for the described incidents.

Most Interesting Chemical: Triethylamine: A clear colorless liquid with a strong ammonia to fish-like odor. Flash point 20°F. Vapors irritate the eyes and mucous membranes. Less dense (6.1 lb / gal) than water. Vapors heavier than air. Produces toxic oxides of nitrogen when burned. (Source: CameoChemicals.NOAA.gov).

 

Review – 5 Advisories and 3 Updates Published –

Today CISA’s NCCIC-ICS published four control system and one medical device security advisory for products from Delta Electronics, Veeder-Root, ASKI Energy, AutomationDirect, and NIHON KOHDEN. They also published updates for advisories for products from Schneider (2) and Hitachi Energy.

Advisories

Delta Advisory - This advisory describes two stack-based buffer overflow vulnerabilities in the Delta ASDA-Soft servo software.

NOTE: I briefly discussed these vulnerabilities on Sunday.

Veeder-Root Advisory - This advisory describes two vulnerabilities in the Veeder-Root TLS4B Automatic Tank Gauge System.

ASKI Advisory - This advisory describes a missing authentication for critical function vulnerability in the ASKI ALS-mini-S4/S8 IP controllers.

NOTE: ASKI Energy is a subsidiary of ABB.

AutomationDirect Advisory - This advisory describes nine vulnerabilities in the AutomationDirect Productivity PLCs.

NIHON KOHDEN Advisory - This advisory describes a NULL pointer dereference vulnerability in the NIHON KOHDEN Central Monitor CNS-6201.

Updates

Schneider Update # 1 - This update provides additional information on the Altivar Products advisory that was originally published on September 16^th, 2025.

Schneider Update #2 - This update provides additional information on the EcoStruxure advisory that was originally published on February 6^th, 2025, and most recently updated on July 15^th, 2025.

Hitachi Energy Update - This update provides additional information on the MACH SCM advisory that was originally published on April 25^th, 2024.

NOTE: I briefly discussed this updated information on October 5^th, 2025.

 

For more information on these advisories, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/5-advisories-and-3-updates-published-3e1 - subscription required.

Review - Bills Introduced – 10-22-25

Yesterday, with just the Senate in Washington (Johnson is still keeping the House out of Washington), there were eight bills introduced. One of those bills will receive additional coverage in this blog: 

S 3032 A bill to extend the authority for the protections of certain facilities and assets from unmanned aircraft. Peters, Gary C. [Sen.-D-MI]

Space Geek Legislation

I would like to mention one bill under my limited Space Geek coverage in this blog:

S  3029 A bill to provide for Department of Energy and National Aeronautics and Space Administration research and development coordination, and for other purposes. Sullivan, Dan [Sen.-R-AK]

 

For more information on these bills, including legislative history for similar bills in the 118^th Congress, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/bills-introduced-10-22-25 - subscription required.

Review – S 2049 Introduced – NTIA Cybersecurity Office

Back in June Sen Hickenlooper (D,CO) introduced S 2049, the NTIA Policy and Cybersecurity Coordination Act. The bill would transform the current NTIA Office of Policy Analysis and Development (OPAD) into the Office of Policy and Cybersecurity Coordination. No new funding is authorized by this legislation.

The bill would amend the National Telecommunications and Information Administration Organization Act by adding a new §106, Office of Policy Development and Cybersecurity.

The bill is essentially the same as S 1526 that was introduced last session by Sne Hickenlooper (D,CO), but no action was taken on that bill in the Senate.

Moving Forward

Hickenlooper, along with all three of his cosponsors {Sen Capito (R,WV), Sen Curtis (R,UT), and Sen Blunt-Rochester (D,DE)}, are members of the Senate Commerce, Science, and Transportation Committee to which this bill was assigned for consideration. This means that there may be sufficient influence to see the bill considered in Committee. I expect that there will some level of bipartisan support for the bill, but it probably will not be sufficient to allow the bill to be considered by the full Senate under the unanimous consent process. This bill is not politically important enough to take up the Senate’s time under regular order.

 

For more information on the provisions of this bill, as well as a commentary on a possible change in the legislative environment for this bill, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/s-2049-introduced-ntia-cybersecurity - subscription required.