Ubuntu 26.10 finishes its coreutils rewrite in Rust, ships cp/mv/rm memory-safe

Ubuntu 26.10 ‘Stonking Stingray’ completes Canonical’s swap from GNU coreutils to the Rust-based uutils reimplementation. The last holdouts—cp, mv, and rm—had stayed on their GNU versions in the 26.04 LTS release because of unresolved TOCTOU (time-of-check-to-time-of-use) race conditions in the Rust ports. With those bugs fixed upstream, the new release now ships a complete Rust command-line toolset spanning ls, cat, chmod, du, and the rest.

The move is part of the ‘oxidising’ effort Canonical started in 2025, betting that Rust’s compile-time memory-safety checks will eliminate a class of bugs that C compilers let through. Ubuntu 25.10 was the first release to ship Rust utilities and to make a Rust-based sudo the default. Canonical has been deliberate about the transition: it paid for a security audit of uutils ahead of 26.04—the audit that surfaced the TOCTOU issues—and it backs the Trifecta Tech Foundation as a gold sponsor at €40,000 a year, funding work that includes a Rust rewrite of NTP that Ubuntu intends to make its default time-sync client by 27.10.

For users, nothing changes functionally. uutils targets drop-in compatibility with GNU coreutils and treats any behavioral divergence as a bug to fix, so the payoff is purely a smaller memory-safety attack surface. The 26.10 beta lands later this month ahead of a stable release on October 15, 2026.