Tag
A heap use-after-free in PHP's session.upload_progress handler (CVE-2026-109618 / -109619) allows attackers to hijack freed bucket pointers and achieve remote code execution via zend_call_function; the writeup includes verified PoC chains for PHP 8.4.4 and 8.2.34 along with pre-patch mitigations.
一篇关于 C++ 内存安全问题的博客文章，探讨 NSA 和欧盟对内存不安全语言的警告，并在纪念 Rainer Grimm 逝世、由社区专家接手维护其博客的背景下展开讨论。
A deep technical blog post introducing a novel reverse-walking borrow checker for the Valen programming language, which traverses functions backward through time to verify memory safety while optionally relaxing shared-xor-mutable rules.
标题指出在 Rust 借用检查器中发现了存在 11 年之久的 unsoundness 缺陷，内容实际为 Rust 主仓库的 README。该发现对 Rust 的内存安全保证具有重要意义。
Valen 的新文章介绍了一种更灵活的借用检查器（group borrowing），编译器会记住引用指向的位置，以实现比 Rust 更简单灵活的内存安全方案，并已被 Google Carbon 等语言采纳。
Sergey 'Shnatsel' Davidoff explains how Rust's SIMD abstractions can now be made safe on the inside, leveraging Rust 1.87's target_feature tracking and CPU feature tokens to eliminate pervasive unsafe blocks around SIMD intrinsics while keeping a+b ergonomics.
Martin Uecker gave a Kernel Recipes 2026 talk on undefined behavior in C, exploring why it exists, how the abstract-machine model enables it, and whether C can eventually become memory-safe.
With 是一门以人体工学/极简仪式感为先的系统编程语言，主打 Rust 级安全（单所有权、生成式引用）与 C 级可达性，通过强推断减少样板代码，并内建对 C 库的直接建模导入，可编译为原生单二进制、无需系统 LLVM。
Vx is a systems programming language for heterogeneous computing (CPU, GPU, NPU) that encodes device memory topologies directly in its type system, using machine files and formal verification to catch data-movement and memory bugs at compile time.
Andrew Plotkin (zarf) reverse-engineers Infocom's classic adventure Infidel with a memory-level debugger and uncovers an egregious wild-pointer compiler bug in the ZIL code that manages objects dropped in the endless desert.
At the 2026 Python Language Summit, David Hewitt presented the Rust for CPython project's proposed roadmap, success criteria, and timeline, proposing optional Rust support starting in Python 3.16 and addressing concerns about platform support and core developer expertise.
Halide introduces wpd, a Rust-based WebP decoder that is memory-safer and significantly faster than libwebp, with up to 3.19x multi-threaded performance gains and near-full feature parity.
Microsoft has promoted Rust to an internal Tier-1 language and is integrating it with the MSVC toolchain for Windows development, including low-level work like drivers and the kernel. A new Rust code generator for rustc underpins production-grade Windows support, signaling deeper investment in memory-safe systems software.
Verdagon details how the experimental Valen programming language enforces memory safety across the Valen/Rust boundary, implementing group borrowing (borrow checking without shared-xor-mutable) while seamlessly calling into Rust functions directly.
The article discusses an ambitious project to revive the Vale programming language and create a new language called Valen, aiming for seamless integration with Rust to enable cross-language generics and memory safety.
Ubuntu 26.10 has completed its migration to Rust-based coreutils, resolving previous security issues and enhancing memory safety without functional changes for users.
This article discusses three programming language features: flow typing for dynamic feel in static languages like Crystal and TypeScript, borrow checking for memory safety in Rust, and contract programming for invariant checking in D.
This article explores static allocation strategies to prevent memory safety bugs such as use-after-free and type confusion, discussing object pools and generational indices, and introducing tricks from TigerStyle for avoiding dynamic memory allocation after initialization.
The Zig devlog introduces pointer stability for ArrayLists to prevent memory safety bugs caused by pointer invalidation during reallocation.
This article explores programming language semantics and its critical role in memory safety, explaining operational, denotational, and axiomatic approaches in an educational context.