Ubuntu 26.10 moves the last three coreutils, cp, mv and rm, to Rust
Ubuntu 26.04 LTS kept three GNU commands because their Rust replacements had eight time-of-check-to-time-of-use bugs. The draft release notes for 26.10 say those are fixed upstream and the whole default set is now uutils. Stable lands October 15.
26.04 kept GNU cp, mv and rm over eight TOCTOU bugs. 26.10 finishes the Rust switch on October 15. Test your scripts.
Every shell script on an Ubuntu server calls cp, mv, and rm, and until this release those three commands were the GNU originals while the rest of coreutils had already moved to Rust. The draft release notes for Ubuntu 26.10, codenamed Stonking Stingray, now say the default core utilities "run entirely on the Rust-based uutils implementation" and that the three holdouts "have now been migrated." The beta arrives later in September. The stable release is scheduled for October 15.
Why three commands waited
Canonical started replacing foundational C tools with Rust ones in 2025, in a program its engineers call oxidising Ubuntu, covering sudo-rs and the uutils coreutils, findutils, and diffutils. Ubuntu 26.04 LTS shipped uutils coreutils 0.8.0 for most commands, LWN reported in April, but held cp, mv, and rm on GNU because the Rust versions carried eight documented time-of-check-to-time-of-use bugs as of April 22. A TOCTOU bug is a gap between the moment a program checks a file and the moment it acts on it; an attacker who can swap the file in that gap can make rm delete something else. For the three commands that move and delete files, Canonical decided that was disqualifying for an LTS.
A security audit Canonical commissioned from Zellic ahead of 26.04 found the issues, per OMG Ubuntu's Joey Sneddon, and the fixes went upstream into uutils. Canonical funds that upstream through a 40,000 euro annual sponsorship of the Trifecta Tech Foundation. With the fixes in, 26.10 finishes the job.
What changes for a user
Nothing, if uutils is doing its job. The project's target is drop-in compatibility with GNU, and Sneddon reports Canonical treats any divergence as a bug. The stated reason for the whole program is the one Rust always gets: memory errors caught at compile time instead of in production. The LWN coverage records the other side of the argument, from GNU coreutils contributor Collin Funk among others: most option behavior is fixed by POSIX, but the long tail of scripts that depend on GNU-specific behavior is millions of files nobody has inventoried, and a six-month window before an LTS is not long enough to find every edge.
To see which implementation a machine is running today:
cp --version | head -1
rm --version | head -1The release notes page is still a draft, with placeholder headings for the kernel and other features. The coreutils line is the one concrete item on it.
Why a build studio cares
Our own site runs on Cloudflare Pages, which does not care what coreutils anyone has. The clients who care are the ones whose vendor left them an Ubuntu box with a cron job, a deploy script, and no test for either. Every one of those scripts calls the three commands that just changed implementation, and the failure mode is not a crash; it is an rm that behaves differently on a symlink or a cp that handles a flag the old way. That is exactly the class of bug a Surface Audit looks for on a vendor-built server, and from October it has a new cause.
The check is cheap. Boot the 26.10 beta in a container, run the deploy scripts, diff the results. If a client is on 26.04 LTS and staying there, nothing changes until 28.04, but the audit note still gets written, because the next upgrade brings it.
Next step: read the 26.10 release notes draft, OMG Ubuntu's report, and LWN's status piece on what was held back and why. If your production server runs scripts nobody has tested against uutils, write to us at hello@gattyworks.com.