Critical software must move away from memory-unsafe languages like C and C++ by January 2026 or face significant security risks, says US Cybersecurity and Infrastructure Security Agency (CISA) and FBI.
Approximately 70% of security vulnerabilities in software systems arise from manual memory management required in languages like C and C++ which leads to critical security flaws that attackers exploit to take control over systems.
By January 2026, companies must either have a clear memory-safety roadmap or transition to memory-safe alternatives for new product lines meant for critical infrastructure or national functions.
The White House had suggested the same, saying experts have identified a few programming languages like C and C++ over which organisations should transition if possible.
C and C++ power many legacy systems and microcontrollers that have been in existence for decades. It is difficult, expensive and prohibitive to transition to a new language and rewrite existing code.
The issue of interoperability is also a concern among developers as C is the bridge between languages, and many languages have a CFFI, making it easy to communicate with each other.
Developers believe that C++ provides extreme performance, less than 1ms response times, very low server footprint, and accomplishing features otherwise dismissed as “not possible at scale”.
There are very few languages that replace C/C++ as they are without runtime. Rust and Zig are memory-safe languages that do not need runtimes.
Legacy systems remain in use because they generate revenue for businesses that rely on them and IT companies that maintain them through expensive support contracts.
Linux is being integrated into the Linux kernel as a second language. This way, companies can slowly move away from languages like C and utilise modern-day languages like Rust while not completely abandoning them.