#industry

DoD Safe Coding Practices and Military / Aerospace Memory-Safety Procurement (2024-2026)

§1 Provenance US Air & Space Forces Magazine, "DOD Plans Quicker Cybersecurity Contractor Standards" (April 2025). https://www.airandspaceforces.com/dod-quicker-contractors-cybersecurity-standards/ Rob Vietmeyer (DoD Chief Software Officer) public remarks, April 2025. Industrial Cyber: "US DoD gets set to develop SWFT framework, issues RFIs to advance secure software development" . https://industrialcyber.co/regulation-standards-and-compliance/us-dod-gets-set-to-develop-swft-framework-issues-rfis-to-advance-secure-software-development-and-authorization/ CMU Software Engineering Institute. "Supporting the Use of CERT Secure Coding Standards in DoD Acquisitions" . https://resources.sei.cmu.edu/library/asset-view.cfm?assetid=28033 CISA / NSA. "The Case for Memory...

CISA Secure-by-Design Pledge and the January 2026 Memory-Safety Deadline

§1 Provenance CISA Secure by Design page: https://www.cisa.gov/securebydesign CISA Secure by Design Pledge: https://www.cisa.gov/securebydesign/pledge Pledge signers list: https://www.cisa.gov/securebydesign/pledge/secure-design-pledge-signers "Product Security Bad Practices" publication (Oct 2024, updated): https://www.ic3.gov/CSA/2024/241016-2.pdf ; CISA page https://www.cisa.gov/resources-tools/resources/product-security-bad-practices CISA Secure by Design Pledge Progress Reports: https://www.cisa.gov/securebydesign/pledge/progress-reports Original announcement (May 2024): "CISA Announces Secure by Design Commitments from Leading Technology Providers" . https://www.cisa.gov/news-events/news/cisa-announces-secure-design-commitments-leading-technology-providers Industry analysis: DEVOPSdigest, "Fix It or Face the Consequences: CISA's Memory-Safe Muster" . https://www.devopsdigest.com/fix-it-or-face-the-consequences-cisas-memory-safe-muster RunSafe...

Use-After-Free Landscape: Temporal vs Spatial, kCFI, and the Proven-by-Construction Story

§1 Provenance MITRE CWE Top 25. CWE-416 (Use After Free) ranked 7th in 2022, 4th in 2023, remains in the top 25 in 2024-2025. White House ONCD, "Back to the Building Blocks" (Feb 2024) — formalises spatial vs temporal vulnerability distinction. IEEE Security & Privacy 2024, "Full Spatial and Temporal Memory Safety for C" , Rutgers. https://people.cs.rutgers.edu/~sn349/papers/safety-sp-2024.pdf CMU SEI, "AI-Powered Memory Safety with the Pointer Ownership Model" . https://www.sei.cmu.edu/blog/ai-powered-memory-safety-with-the-pointer-ownership-model/ RunSafe...

curl, Daniel Stenberg, and the "Is C/C++ The Actual Problem?" Debate

§1 Provenance Daniel Stenberg blog: https://daniel.haxx.se/blog/ Stenberg, "half of curl's vulnerabilities are C mistakes" , March 2021. https://daniel.haxx.se/blog/2021/03/09/half-of-curls-vulnerabilities-are-c-mistakes/ Stenberg, December 2024 follow-up post (URL pattern: https://daniel.haxx.se/blog/2024/12/12/) , discussing CVE-2024-11053 and updating the C-attributable percentage to ~40%. The New Stack, "Curl's Daniel Stenberg on Securing 180,000 Lines of C Code" . https://thenewstack.io/curls-daniel-stenberg-on-securing-180000-lines-of-c-code/ Software Engineering Radio episode 688 (Oct 2025), "Daniel Stenberg on Removing Rust from Curl" . https://se-radio.net/2025/10/se-radio-688-daniel-stenberg-on-removing-rust-from-curl/ Slideshare deck, "rust...

NSA "Software Memory Safety" Guidance (2022) and the June 2025 Reissue

§1 Provenance NSA. "Software Memory Safety" Cybersecurity Information Sheet, November 2022. https://www.nsa.gov/Press-Room/News-Highlights/Article/Article/3215760/nsa-releases-guidance-on-how-to-protect-against-software-memory-safety-issues/ NSA + CISA joint CSI. "Memory Safe Languages: Reducing Vulnerabilities in Modern Software Development" , June 2025. U/OO/172709-25 | PP-25-2574. https://media.defense.gov/2025/Jun/23/2003742198/-1/-1/0/CSI_MEMORY_SAFE_LANGUAGES_REDUCING_VULNERABILITIES_IN_MODERN_SOFTWARE_DEVELOPMENT.PDF CISA alert (June 24, 2025): "New Guidance Released for Reducing Memory-Related Vulnerabilities" . https://www.cisa.gov/news-events/alerts/2025/06/24/new-guidance-released-reducing-memory-related-vulnerabilities NSA press release on the 2025 CSI: https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/4223298/ CISA / NSA joint "The Case for Memory Safe Roadmaps" (2023). Coverage: The Register, "CISA,...

EU Cyber Resilience Act and Memory Safety

§1 Provenance European Commission, Cyber Resilience Act main page. https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act CRA Reporting Obligations page. https://digital-strategy.ec.europa.eu/en/policies/cra-reporting CRA legislative-text summary. https://digital-strategy.ec.europa.eu/en/policies/cra-summary Hogan Lovells client alert, "EU Cyber Resilience Act: Key 2026 milestones toward CRA compliance" . https://www.hoganlovells.com/en/publications/eu-cyber-resilience-act-getting-ready-for-cra-compliance-in-2026 OpenSSF analysis of the CRA. https://openssf.org/public-policy/eu-cyber-resilience-act/ Keysight, "One Year Countdown to EU CRA Compliance — September 11, 2026, Changes Everything" . https://www.keysight.com/blogs/en/tech/nwvs/2025/09/11/one-year-countdown-to-eu-cra-compliance-september-11-2026-changes-everything ScanReco, "Current state of the EU Cyber Resilience Act — and why no-one...

Chrome Memory-Safety Data and the Rust-in-Chrome Rollout

§1 Provenance Chrome Security quarterly summaries: https://www.chromium.org/Home/chromium-security/quarterly-updates/ Q1 2024 : https://groups.google.com/a/chromium.org/g/chromium-dev/c/K_HO5LsPDKc Q2 2024 : https://groups.google.com/a/chromium.org/g/chromium-dev/c/cMM7RIc1kZI Q3 2024 : https://groups.google.com/a/chromium.org/g/chromium-dev/c/KOmfh5BW6Mw Q3 2025 : https://groups.google.com/a/chromium.org/g/security-dev/c/s-UR_4pJvOY Chromium memory-safety policy page: https://www.chromium.org/Home/chromium-security/memory-safety/ V8 Sandbox README: https://chromium.googlesource.com/v8/v8.git/+/refs/heads/main/src/sandbox/README.md 2025 vulnerability landscape: Quttera, "Inside Chrome's 2025 Vulnerability Landscape: 80 CVEs Revealed in V8 and Core Components" . https://blog.quttera.com/post/inside-chrome-80-vulnerabilities-since-jan-2025 Penligent AI, "Chrome Zero-Day Vulnerabilities Exploited in 2025" (CVE-2025-14174 analysis). https://www.penligent.ai/hackinglabs/chrome-zero-day-vulnerabilities-exploited-in-2025-a-comprehensive-analysis-of-cve-2025-14174-v8-type-confusion-and-sandbox-escapes/ §2 Data Chrome's published memory-safety rollout (selected highlights,...

Industry, Policy, and Deployment Data

White House ONCD "Back to the Building Blocks" (February 2024)

§1 Provenance White House Office of the National Cyber Director. "Back to the Building Blocks: A Path Toward Secure and Measurable Software" , February 2024. 19 pages. https://bidenwhitehouse.archives.gov/wp-content/uploads/2024/02/Final-ONCD-Technical-Report.pdf Press release: https://bidenwhitehouse.archives.gov/oncd/briefing-room/2024/02/26/press-release-technical-report/ Anjana Rajan, Assistant National Cyber Director for Technology Security — primary spokesperson at release. Coverage: Tom's Hardware, "White House urges developers to avoid C and C++, use 'memory-safe' programming languages" . https://www.tomshardware.com/software/security-software/white-house-urges-developers-to-avoid-c-and-c-use-memory-safe-programming-languages The Record from Recorded Future News, "After...

Google: Android Rust, Chrome Rust, V8 Sandbox

§1 Provenance Google Online Security Blog. "Rust in Android: move fast and fix things" (Nov 2025). https://security.googleblog.com/2025/11/rust-in-android-move-fast-fix-things.html Coverage: The Hacker News, "Rust Adoption Drives Android Memory Safety Bugs Below 20% for First Time" (Nov 2025). https://thehackernews.com/2025/11/rust-adoption-drives-android-memory.html 2024 baseline: The Hacker News, "Google's Shift to Rust Programming Cuts Android Memory Vulnerabilities by 68%" (Sep 2024). https://thehackernews.com/2024/09/googles-shift-to-rust-programming-cuts.html The Register, "Google's Rust belts bugs out of Android in Safe Coding push" (Sep 2024)....

Microsoft "70% of CVEs Are Memory Safety" Statistic

§1 Provenance Miller (MSRC). "Trends, challenges, and strategic shifts in the software vulnerability mitigation landscape" , BlueHat IL 2019. Primary source for the 70% number. MSRC blog: "A proactive approach to more secure code" (Jul 2019). https://www.microsoft.com/en-us/msrc/blog/2019/07/a-proactive-approach-to-more-secure-code MSRC blog: "We need a safer systems programming language" (Jul 2019). https://www.microsoft.com/en-us/msrc/blog/2019/07/we-need-a-safer-systems-programming-language CISA. "The Urgent Need for Memory Safety in Software Products" (Dec 2023). https://www.cisa.gov/news-events/news/urgent-need-memory-safety-software-products NSA/CISA Joint Cybersecurity Information Sheet (June 2025). U/OO/172709-25...