CISA and NSA Urge Shift to Memory-Safe Languages Like Rust to Eliminate Memory Vulnerabilities
Joint reports from CISA and NSA emphasize that memory safety remains the dominant source of exploitable vulnerabilities despite years of developer training, fuzzing, static analysis and runtime mitigations. The June 2025 document "Memory Safe Languages: Reducing Vulnerabilities in Modern Software Development" states that the burden of safety must shift from developer discipline to language design itself.
Statistics cited across multiple reports show that roughly 70% of Microsoft vulnerabilities between 2006 and 2018 and 75% of real-world exploited CVEs tracked by Google Project Zero involve memory safety errors. Mozilla data indicated 32 of 34 critical bugs were memory-related, while 67% of 2021 zero-days fell into the same category.
Google detailed Rust adoption results in Android, reporting that memory-related vulnerabilities dropped below 20% of total issues in 2025. Rust code exhibited a vulnerability density of 0.2 per million lines of code versus approximately 1000 per million lines for historical C and C++ code in the same codebase.
Rust's ownership system ensures each value has exactly one owner, with automatic deterministic deallocation when the owner goes out of scope. Borrowing rules enforce that mutable references are unique and shared references are immutable, giving the LLVM backend information that enables aggressive optimizations such as register allocation improvements and elimination of redundant memory loads.
Move semantics in Rust are destructive at the compiler level, avoiding the valid-but-unspecified state left by C++ moves and eliminating unnecessary destructor calls. This contributes to measurable gains, including rollback rates roughly four times lower than C++ and 25% less time spent on code review according to DORA metrics.
The reports acknowledge practical barriers: incomplete third-party library coverage, inter-language communication overhead, significant training investment and uneven ecosystem maturity in areas such as numerical computing, graphics and embedded development. Microsoft has elevated Rust to Tier-1 status internally and is advancing Rust for Windows driver development.
While C++26 introduces initial memory-safety hardening and a hardened standard library, more comprehensive safety profiles remain targeted for C++29. Regulators and large organizations now view Rust as the default choice for new critical code, with Microsoft aiming to migrate millions of lines from C and C++ by 2030.
Related articles
Russian CA TCI Integrates ACME Protocol to Automate TLS Certificate Issuance
The Technical Center Internet (TCI), part of RTK-COD, has deployed a production ACME server compatible with standard clients such as acme.sh, Certbot and lego. The implementation aligns the ACME state machine with the existing isolated signing infrastructure, Domain Control Validation mechanisms and mandatory Certificate Transparency logging to Yandex and VK CT logs. Certificate lifetimes are shortening industry-wide, with Web PKI limits dropping to 47 days by 2029, making manual issuance unsustainable. The service supports HTTP-01 and DNS-01 challenges, ECDSA P-256 keys and certificate revocation, while preserving the requirement for Subject/CN in CSRs and mandatory revocation reasons. A separate staging environment uses an internal CT log simulator for safe testing. Future plans include full multi-SAN support, ARI (RFC 9773) and removal of the Subject/CN restriction.
Russia Pushes Corporate Multibanking Forward with Updated Open API Standards
The Bank of Russia and AFT have advanced Open Banking standards that enable corporate clients to aggregate account data across multiple banks within a single interface. The new specifications cover consent management, security profiles based on STO BR FAPI and OpenID Connect, and account information retrieval for both individuals and legal entities. While the 2025 pilot results demonstrated practical use cases such as personal financial assistants and corporate multibanking, the updated standards effective from October 2026 still lack a unified initiation-of-transfer component. Developers must therefore combine the new account-data APIs with separate bank-specific payment initiation mechanisms. The article explores how accounting systems or independent fintech services could become the primary workspace for financial directors managing payments, payroll, and liquidity across several banks. It also examines real-world challenges including idempotency handling, status reconciliation after network failures, and the separation of application permissions from signer authority. Examples from the UK Open Banking Limited sweeping VRP statistics illustrate how pre-authorized variable recurring payments can streamline operations while highlighting the additional policy work required for corporate supplier payments in Russia.
Hacker Attacks as Force Majeure: Russian and International Courts Diverge on Liability for Cyber Incidents
In November 2026, Russian hosting provider Beget suffered a major cyber attack that disrupted websites, virtual servers, email, DNS, and control panels for thousands of clients. Beget notified customers of circumstances resembling force majeure under Article 401 of the Russian Civil Code but stopped short of claiming automatic court recognition. Russian courts have reached inconsistent rulings on whether DDoS attacks and ransomware qualify as extraordinary and unavoidable events, examining factors such as attack scale, provider preparedness, and contractual obligations. International cases from France, Norway, the United States, and the Netherlands further illustrate that outcomes depend on evidence of prior security measures, backup integrity, and specific contractual language rather than the mere occurrence of an attack. Key precedents include disputes involving Timeweb, Expeditors, and Nordlo Haugesund where liability was limited or denied despite confirmed incidents. The analysis shows that even when force majeure is rejected, clients often struggle to recover full losses due to liability caps and proof requirements. Businesses are advised to maintain independent backups, review service agreements, and document incidents thoroughly to protect against financial exposure.
US Mandates Removal of Acronis from Federal Systems by January 2027 Over Russian Ties
US federal civilian agencies have been ordered to remove all Acronis products from their information systems by January 27, 2027, with new purchases also prohibited. The directive from the Department of Homeland Security, signed on July 31 and published in the Federal Register on October 30, covers Acronis AG along with Acronis Inc. and Acronis SCS. A nearly decade-long review examined whether Russian developers still access the code and whether supply chain risks have been sufficiently reduced, though no specific evidence of backdoors was reported by sources. After 2022, Acronis suspended operations in Russia and relocated specialists, while in 2025 Swedish firm EQT acquired a controlling stake with approval from the US CFIUS committee. Despite over 75 percent of shares now held by Western investors, these measures proved insufficient for continued access to federal systems. The ban does not extend to the private US market.