From Rust Blog · 21 stories
ClickFix Social Engineering Attack Raises Cybersecurity Concerns
The ClickFix attack method, based on social engineering with fake prompts leading to manual malware execution, is growing in popularity, targeting Microsoft 365 accounts, Mac users, and more. The attacks bypass traditional security by exploiting user habits, presenting a significant threat to organizational and individual cyber defenses. This trend is concerning as it shows an evolution in cybercrime techniques, requiring awareness and new defensive measures.
Malicious `proc-macro1` crate leads to supply chain attack on `arrayref` and other Rust crates
The Rust Security Response Team identified and removed several malicious crates, including `proc-macro1`, which was used in a supply chain attack to compromise popular crates like `arrayref`, `internment`, and `append-only-vec`. This incident highlights the vulnerability of software supply chains to malicious package injections and necessitates developers to verify their dependencies.
Rust Enables Polonius Alpha Borrow Checker on Nightly Builds
The Rust team has enabled the Polonius Alpha borrow checker on nightly builds, preparing for stabilization in the coming months. This new iteration allows more code to compile by enabling flow-sensitive borrow checking of lifetime outlives relationships, addressing limitations of the current NLL borrow checker.
Rustup 1.29.2 Released, Addresses CVE-2026-111943 Security Vulnerability
Rustup 1.29.2 has been released, updating `rustls-webpki` and `webpki-root-certs` dependencies. This update resolves the eMudhra intermediate certificates issue detailed in CVE-2026-111943.
Rust 1.99.1 Released, Fixing Regressions in wcslen, FFI bool, and rust-lld
The Rust team released version 1.99.1, a point release addressing several regressions from prior versions. This update resolves issues with missing `wcslen` symbols, miscompilation of FFI boolean return values on x86_64, and `rust-lld` failing to load `libLLVM` on macOS.
Rust 1.100.0 Demotes 32-bit Windows Targets, Requires Cross-Compilation
Rust 1.100.0 will demote i686-pc-windows-msvc and i686-pc-windows-gnu targets, removing host tools for 32-bit Windows. Users will need to cross-compile 32-bit Windows binaries from supported 64-bit toolchains, as 32-bit x86 CPUs are outdated and building toolchains for them has become problematic.
Rust 1.99.0 Released, Stabilizing C-ABI Variadics and Raw Pointer Layout Info
Rust 1.99.0 has been released, introducing stable support for defining C-ABI variadic functions and clarifying safety requirements for retrieving layout information from raw pointers. These updates allow Rust developers to write C-compatible variadic functions directly in Rust and provide clearer guidelines for memory management with raw pointers.
Rust Project Appoints Scott Schafer as Full-Time Cargo Maintainer in Residence
The Rust Project has appointed Scott Schafer as a full-time Maintainer in Residence for the Cargo team, funded by the Rust Foundation Maintainers Fund, the Rust Leadership Council, and AWS. This appointment aims to address the maintenance challenges and backlog faced by Cargo, Rust's build system and package manager.
Miri Caching Vulnerability Exposes Secrets in GitHub Actions
The Rust Security Response Team identified a vulnerability where Miri, when used with GitHub Actions caching, could expose environment variables containing secrets to pull requests. Miri's practice of storing all environment variables in the `target/` directory, which is often cached, allowed unauthorized access to sensitive information.
Rust 1.98.0 Released with Algebraic Floating-Point Methods and Buffered Integer Formatting
The Rust team released version 1.98.0, introducing new "algebraic" methods for floating-point operations and a `format_into` method for buffered integer formatting. These updates provide developers with more control over floating-point optimizations and offer performance improvements for integer formatting.
Rust Project Funds First Maintainers in Residence and Grant Recipients
The Rust Project announced its first Maintainers in Residence and Maintainer Grant recipients, providing financial support for key contributors to work on Rust maintenance activities for at least 12 months. This initiative aims to ensure the long-term health and stability of critical Rust components by funding dedicated maintainer time.
Rust 1.96.1 and 1.97.1 Released with Critical Fixes and Stability Improvements
The Rust team has released versions 1.96.1 and 1.97.1, focusing on critical security and stability updates. Rust 1.96.1 addresses security vulnerabilities in libssh2, while 1.97.1 resolves a miscompilation issue stemming from an LLVM optimization. These versions aim to increase the reliability and security of Rust applications.
Crates.io Adds Code Viewer and Decouples Accounts from GitHub
Crates.io has introduced a new Code tab for browsing published crate versions and is untangling account identities from GitHub. This update simplifies dependency audits and paves the way for broader login options, improving overall usability.
Rust Foundation Launches Maintainers Fund to Support Developers
The Rust Foundation has launched the Rust Foundation Maintainers Fund (RFMF) to financially support Rust maintainers. The fund aims to ensure proper support for maintainers of critical Rust projects, enabling them to focus on key development activities.
Rust Security Team Addresses Cargo Vulnerabilities (CVE-2026-5222 & CVE-2026-5223)
The Rust Security Response Team has identified two vulnerabilities in Cargo, impacting third-party registries. CVE-2026-5222 is a low-severity issue allowing potential credential exposure, while CVE-2026-5223 is a medium-severity issue that could allow malicious code to overwrite other crates. Rust 1.96.0, releasing May 28, 2026, will address these issues.
Rust Project concludes 2025H2 Goals with updates on 41 objectives
The Rust Project has completed its 2025H2 period, accomplishing 41 Project Goals, including 13 Flagship Goals. Updates indicate ongoing work will continue into 2026, reflecting the project's commitment to enhancing the Rust programming language.
Rust 1.97 raises baseline for NVPTX compilation target impacting older CUDA drivers
Rust 1.97, scheduled for July 9, 2026, will raise the baseline PTX ISA version and GPU architecture for the nvptx64-nvidia-cuda target. This change makes older GPU architectures and CUDA drivers incompatible with the new Rust version, but affects mostly outdated technology no longer supported by NVIDIA.
Insights from Learning Rust: Experiences and Resources
A recent study highlighted various paths learners take to acquire Rust programming skills and the resources they utilize. Recommendations from experienced developers cover a range of official documentation and community-generated materials, demonstrating diverse learning preferences.
Rust Project Announces 13 Accepted GSoC 2026 Projects Amid Increased Submissions
The Rust Project announced 13 accepted projects for Google Summer of Code (GSoC) 2026, chosen from 96 proposals, reflecting growing interest in open-source contributions. The Rust Project also joins Outreachy for May 2026 to support underrepresented groups in tech. The increase in interest highlights the challenges of managing AI-generated submissions in open-source projects.
Rust Debugging Survey 2026 Results Highlight Developer Practices and Challenges
A recent survey of over 2,300 Rust developers revealed that over half do not currently use a debugger, with print debugging and the `dbg!` macro being the most common methods. The findings indicate that debugging challenges contribute to some developers discontinuing Rust use, highlighting an area for improvement in the Rust development experience.
Guide to Funding Rust Project Contributors and Maintenance
The Rust Project outlined three ways to fund its development: donating to the Rust Foundation Maintainers Fund, sponsoring specific Project Goals, or directly supporting individual contributors via GitHub Sponsors. This initiative addresses the increasing workload and reliance on volunteers, aiming to improve maintenance and accelerate feature development.