“52% of critical open-source projects analyzed contain code written in memory-unsafe languages.”
CISA looked at 172 critical open-source projects and found 55 percent of all their lines in memory-unsafe languages. Linux is 95 percent unsafe, glibc 85 and Tor 93. The ten largest projects are all more than 26 percent unsafe. CISA’s advice is to rewrite in Rust, Java or Go, and its own report expects C to stay wherever performance matters. That covers the networking, crypto and kernel code attackers actually hit.