Short Takes – 11-11-25

Antibiotic found hiding in plain sight could treat dangerous infections, early study finds. LiveScience.com article. Pull quote: “This systematic approach allowed the team to isolate two never-before-seen molecules, which they named pre-methylenomycin C and pre-methylenomycin C lactone. After using an array of techniques to thoroughly characterize the structures of these compounds, they investigated the molecules' biological activity against a panel of bacterial strains.” Outlines an interesting technique for following metabolic chemical development.

Canada Loses Measles Elimination Status After Ongoing Outbreaks. MedPageToday.com article. Pull quote: “But vaccination rates have since slipped below the 95% coverage rate needed to stop outbreaks. Large outbreaks in Venezuela and Brazil in 2018 and 2019 cost the region [the Americas] its elimination status. It was reclaimed in 2024, but ends again with Canada's loss.”

FAA restricts commercial rocket launches indefinitely due to air traffic risks from government shutdown. Space.com article. Pull quote: “Beginning 6 a.m. EST (1100 GMT) on Nov. 10, commercial launches to space can only take place between the hours of 10 p.m. EST (0300 GMT) and 6 a.m. EST (1100 GMT), according to the FAA order. This will help keep airspace restrictions in Florida, near NASA's Kennedy Space Center and Cape Canaveral Space Force Station, as well as Vandenberg Space Force Station in California, to a minimum while air traffic delays stack up due to staffing shortages caused by the government shutdown.”

If another country tested nuclear weapons, here’s how we’d know. ScienceNews.com article. Pull quote: “It’s difficult to say anything useful when it’s all in such an ambiguous context [talking about ‘non-explosive testing’]. But what I can say, if they were testing weapons in the traditional sense of setting off nuclear tests and designing weapons and improving them, we would know about that. If we were detecting little magnitude 5 earthquakes in these test sites, we would suspect those were nuclear tests, and that is certainly not happening.”

Exploiting AgTech connectivity to corner the grain market. PenTestPartners.com blog post. Pull quote: “Now we understood why the [cloud platform] service was free: that [harvest] data would allow the combine manufacturer to know crop yields before the market did. The opportunity to take a long or short position on grain futures was huge! We’re not suggesting that the manufacturers actually do this, but the temptation would be significant.”

Adventures in EM Side-channel Attacks. NCCGroup.com blog post. Pull quote: “We consider this a success, as we were able to replicate the signal capture from the original research in only two weeks, using lab-fabricated equipment and a number of expediencies. Employing the same equipment on other targets should be straightforward, and likely easier, given that the Infineon security element is one of the hardest targets out there.”

EO 14357 – Modifying Duties Addressing the Synthetic Opioid Supply Chain in the People's Republic of China – Federal Register

EO 14358 – Modifying Reciprocal Tariff Rates Consistent With the Economic and Trade Arrangement Between the United States and the People's Republic of China – Federal Register

Backlog List

• Periodic Graphics: Faking flavors with chemistry,

• Scientists Map Microbiome Hidden Deep inside Tree Trunks,

• This reaction turns Teflon into toothpaste’s key ingredient,

• Enclosed-Space Fatalities Continue Despite New IMO Safety Rules, Industry Survey Seeks Answers, and

• This ‘minor’ bird flu strain has potential to spark human pandemic.

Review - Bills Introduced – 11-10-25

Yesterday, with just the Senate in Washington, there were 44 bills introduced. Only one of those bills will receive additional coverage in this blog:

HR 6009 Defense Biotechnology Strategy Act Houlahan, Chrissy [Rep.-D-PA-6]

For more information on these bills, including legislative history for similar bills in the 118^th Congress, as well as a mention in passing about two maritime disaster resolutions, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/bills-introduced-11-10-25 - subscription required.

Review – Public ICS Disclosures – Week of 11-1-25 – Part 2

For Part 2 this week we have three additional vendor disclosures from WAGO and Westermo (2). We also have four vendor updates from Dell (2), FortiGuard, and Moxa. There are three researcher reports of vulnerabilities in products from Geutebruck and Ilevia (2). Finally, we have an exploit for products from WatchGuard.

Advisories

WAGO Advisory - CERT-VDE published an advisory that discusses three vulnerabilities in multiple WAGO products.

Westermo Advisory #1 - Westermo published an advisory that describes a path traversal vulnerability in their WeOS5 operating system.

Westermo Advisory #2 - Westermo published an advisory that describes a command injection vulnerability in their WeOS 5 operating system.

Vendor Updates

Dell Update #1 - Dell published an update for their EMC Ruckus Wireless Controller advisory that was originally published on December 17^th, 2021.

Dell Update #2 - Dell published an update for their Windows IoT Enterprise LTSC advisory that was originally published on October 31^st, 2025.

FortiGuard Update - FortiGuard published an update for their cw_stad daemon advisory that was originally published on July 8^th, 2025.

Moxa Update - Moxa published an update for their Diffie-Hellman Key Exchange advisory that was originally published on June 2^nd, 2025.

Researcher Reports

Geutebruck Report - Black Lantern Security published a report about an SQL injection vulnerability in the Geutebruck G-Cam Series Cameras.

Ilevia Reports - Zero Science published three reports about vulnerabilities in the Ilevia EVE X1/X5 Server.

Exploits

WatchGuard Exploit - Chanakya Neelarapu and Mark Gibson published an exploit for a use of default credentials vulnerability in the Watch Guard Firebox devices.

For more information on these disclosures, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-11-42e - subscription required.

Review – HR 4590 Introduced – Codifying EO 14305

Back in July Rep Finstad (R,MN) introduced HR 4590, that would codify Executive Order 14305, Restoring American Airspace Sovereignty. That EO notes that it is “the policy of the United States to ensure control over our national airspace and to protect the public, critical infrastructure, mass gathering events, and military and sensitive government installations and operations from threats posed by the careless or unlawful use of UAS.” No new spending is authorized.

Moving Forward

Finstad is not a member of the House Transportation and Infrastructure Committee to which this bill was assigned for primary consideration. This means that it is unlikely that there will be sufficient influence to see the bill considered in Committee. I suspect that the bill would not receive much support from Committee leadership as it would dilute the Committee’s efforts to pass a more comprehensive cUAS bill.

Three additional committees are also generally required to approve consideration of this bill before it moves to the House. The Energy and Commerce Committee would not be expected to  move forward any bill sponsored by the T&I committee as that Committee has advanced a bill (HR 5061) that would remove the E&C committee from oversight of cUAS activities. Thus, unless the Speaker overrides the objections of the E&C committee, this bill will not be able to move forward to the floor of the House.

 

For more information on the provisions of this bill and its underlying executive order, including a commentary on codifying executive orders, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/hr-4590-introduced-codifying-eo-14305 - subscription required.

Chemical Incident Reporting – Week of 11-1-25

NOTE: See here for series background.

Artesia, NM – 10-31-25

Local News Report: Here, here, here, and here.

There was an explosion and fire at a local refinery. Three people were transported to hospital (possibly one by helicopter) for treatment. There is no description of the damage or estimate of cost of damage.

Probable CSB reportable.

Sacramento, CA – 11-4-25

Local News Report: Here, here, here, and here.

There was an industrial accident where a forklift struck a pressure relief valve on an ammonia storage tank. The release injured one worker (hospitalized) and resulted in local evacuations.

Probable CSB reportable.

Review – Public ICS Disclosures – Week of 11-1-25 – Part 1

This week we bulk disclosures from QNAP (11). We also have nine additional vendor disclosures from ABB, Advantech, Eaton (2), Meinberg, Mitsubishi, Moxa, and Philips (2).

Bulk Disclosure – QNAP

• Vulnerability in QuMagie,

• Multiple Vulnerabilities in Download Station,

• Multiple Vulnerabilities in File Station 5,

• Vulnerability in Notification Center,

• Vulnerability in Qsync Central,

• Multiple Vulnerabilities in QuLog Center,

• Vulnerability in QuMagie,

• Vulnerability in Malware Remover (PWN2OWN 2025),

• Multiple Vulnerabilities in QTS and QuTS hero (PWN2OWN 2025),

• Multiple Vulnerabilities in HBS 3 Hybrid Backup Sync (PWN2ONW 2025),

• Vulnerability in Hyper Data Protector (PWN2OWN 2025)

Advisories

ABB Advisory - ABB published an advisory that discusses a path traversal vulnerability (with publicly available exploit) in their PMC 600 protection and control IED manager.

Advantech Advisory - Advantech published an advisory that describes 12 vulnerabilities in their WebAccess/VPN portal.

Eaton Advisory #1 - Eaton published an advisory that describes a missing authentication for critical function vulnerability in their Brightlayer Software Suite.

Eaton Advisory #2 - Eaton published an advisory that describes an unrestricted upload of file with dangerous type vulnerability in their Brightlayer Software Suite.

Meinberg Advisory - Meinberg published an advisory that discusses 12 vulnerabilities (3 with publicly available exploits) in their Lantime product. These are third-party vulnerabilities.

Mitsubishi Advisory - Mitsubishi published an advisory that describes an improper validation of specified quantity in input vulnerability in their MELSEC iQ-F Series CPU module.

Moxa Advisory - Moxa published an advisory that discusses an uncontrolled resource consumption vulnerability (with publicly available exploit) in multiple Moxa products.

Philips Advisory #1 - Philips published an advisory that discuses an ASP.NET core HTTP request/response smuggling vulnerability.

Philips Advisory #2 - Philips published an advisory that discusses the Glassworm malware campaign.

 

For more information on these disclosures, including links to 3^rd party advisories, researcher reports, and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-11-ab7 - subscription required.

Personal Note – 11-9-25

On Friday, while at work, I had a brief period of aphasia, in my case for a period of 30 minutes to an hour I had problems speaking coherent thoughts. My supervisor was concerned and I was transported to the emergency room by ambulance. I was well aware that sudden onset aphasia like that is frequently a sign of a stroke, though I had no other stroke-like symptoms, so I did not object.

After spending the evening in the emergency room, I was admitted to the hospital overnight for observation. After a whole series of tests, poking, and prodding where no brain bleeds or blockages were detected, I was diagnosed with a possible Transient Ischemic Attack (TIA). However, I had also been in the early stages of a migraine attack when the aphasia occurred, so there was a possibility that this could have just been a new phase in my lovely migraine experiences. I was put on a blood thinner for 21 days and warned to watch for any other potential signs of a stroke.

Strokes and dementia are the two illnesses of old age that concern me the most. I have been taking an enteric aspirin for years and frequently do a standard self-diagnostic test (smile, laugh, and recite a stanza of the Jabberwocky; learned some new ones this weekend) for the signs of a stroke. Not much that I can do about dementia, besides staying mentally active, my writing helps there.

I got home late yesterday afternoon and rested up (though I did watch the Bama game, ROLL TIDE); you do not actually get much rest in the hospital. Staying home today on the advice of doctor and family, but I will take that time to get caught up on my standard weekend writing fare; that still counts as taking it easy in my mind.