Topic
Field of eliminating memory-corruption vulnerabilities through memory-safe languages, migration roadmaps, and compiler/hardware mitigations for C and C++ code.
Rust issue #164250 reports a borrow-checker unsoundness that reproduces on stable, with variants compiling since 1.18.0 in 2017. Exploiting it takes a deliberately hostile Drop impl, and the team downgraded it from P-critical to P-high.
Reality
Google quadrupled the Chrome VRP base reward for memory corruption bugs to $2,000, up from the $500 it set in April. SecurityWeek reports the new rates are still well below those paid before April, so the change restores part of a cut.
Reality
Google's Chrome 155 decodes JPEG XL natively with jxl-rs, the browser's first complete image decoder written in a memory-safe language. Any site can now serve .jxl images to Chrome without plugins or experimental flags, so the format is a production option for Chrome traffic.
Reality
Pwn2Own Ireland teams logged 32 zero-days and over $368,000 in prizes on October 6, breaking LiteLLM, OpenAI Codex and Oracle's AI database. Vendors now have 90 days to ship fixes before the Zero Day Initiative publishes the details.
Reality
Google released an official Swift SDK for more than 100 Cloud services, so teams that build Apple apps can write their servers in Swift too. At version 0.4.0 its maintainers still reserve breaking changes before 1.0, and production readiness is for adopters to establish.
Reality
D-Link's DIR-822A firmware A_101 has two critical flaws, scored 9.9 and 10.0, with public proof-of-concept code and no fixed release yet. Until D-Link ships a build, owners are left isolating the router from untrusted networks or planning its replacement.
Reality
A time-of-check/time-of-use bug in the library many platforms use to run untrusted JavaScript lets guest code reach the host process. Fixes are in 6.2.0 and 7.0.1, and there is still no CVE.
Reality
The affected releases stretch back to Next.js 13.4, and for Windows self-hosters the only remedy Vercel offers is the version bump. The AVIF bug shipped in the same release at least has a config gate.
Reality
Cloudflare pointed Anthropic's Mythos Preview at more than fifty of its own repositories and watched it write, compile and run its own proofs of exploitability. Its refusals on identical code did not repeat.
Reality
The maintenance release for the 1.6 branch carries seven fixes with GitHub advisory IDs and six that involve memory corruption. It also lets a running IEC 61850 server take a new TLS configuration.
Reality
Jarred Sumner's four-month rewrite checked transpiled Rust against a TypeScript suite that does not depend on the implementation language, and reaching a fully passing run cost about $165,000 in tokens.
Reality
Bun's port from Zig to Rust landed in four months because its test suite was written in TypeScript, independent of the language underneath, and because separate agents wrote the code and reviewed it.
Reality
The fixes are already upstream, so the work now is confirming your distribution shipped them before someone with a low-privileged shell on a shared host uses the published code to reach root.
Reality
A practical dev.to guide sets out the low-level and high-level tracks for writing CUDA kernels in Rust, then demonstrates them with a nightly-only kernel whose body dereferences three raw pointers inside an unsafe function.
Reality
A year on from the CISA and NSA memory-safety report, the adoption evidence is still provider roadmaps and practitioner judgement about C and C++ code that nobody proposes to rewrite wholesale.
Reality
CrowdStrike's IPC template declared 21 input fields and the integration code supplied 20, a mismatch that compiled cleanly, and the channel file used in testing skipped that field as well.
Reality
The industry is still shipping the defect classes CISA has flagged for years. The case that AI coding assistants will multiply them comes from two named practitioners, not from the agency's own data.
Reality
The Dutch NCSC expects mass exploitation attempts on two CVSS 9.8 Check Point VPN flaws that run code before authentication. Both sit in certificate parsing, and one of them reaches the Security Management Server.
Reality
Onapsis, which found the flaw alongside SAP, rates it CVSS 10.0 and recommends immediate patching. A second kernel note in the same batch reaches every S/4HANA 2025 system and any older release already on a current kernel.
Reality
V8 says 60% of the Chrome exploits caught in the wild between 2021 and 2023 started in its own code, and that the logic bugs behind them are out of reach of both Rust and memory tagging, so the work went into containment.
Reality
Security · September 10, 2026 · One report1 publisher
Security · September 4, 2026 · Confirmed9 publishers
Security · August 26, 2026 · Confirmed2 publishers