Governments have told the software industry to stop writing memory-unsafe code. Here is what that means for the systems you run, and why the migration is cheaper on your timeline than on someone else's.
What happened
In February 2024, the White House Office of the National Cyber Director published a report calling on the technology industry to adopt memory-safe programming languages, following guidance from CISA, the NSA, and allied cybersecurity agencies. The reasoning was arithmetic: the majority of serious vulnerabilities in large C and C++ codebases are memory-safety bugs, an entire class of defects that memory-safe languages eliminate at compile time.
The direction is settled. Rust now runs inside the Linux kernel, Windows, Android, and the infrastructure of major cloud providers. Procurement frameworks in government and critical infrastructure are beginning to ask for memory-safety roadmaps.
What it means for PHP, Java, and Node
The mandate talks about C and C++, and organizations running PHP, Java, or Node sometimes conclude it does not apply to them. It applies differently. Those languages are memory-safe in the narrow sense, but the systems written in them a decade ago carry other structural costs: performance that requires ten times the hardware, dependency trees nobody has audited, and a talent market that is moving on.
The question is not whether those systems will be rewritten this decade. It is whether the rewrite is planned or forced.
Why "rewrite" is the wrong word
Full rewrites fail. They take twice as long as planned, the old system keeps changing underneath, and the business runs two platforms for years. The alternative is migration: new Rust services placed beside the old ones, receiving mirrored traffic, compared automatically, and switched over one at a time when the numbers match. The old system is never turned off until the new one has proven itself on real production traffic. We have done this on live platforms. It is slower to start and faster to finish.
What to do in 2027
Map your systems. Most organizations discover services they forgot they had. Rank them by risk, value, and coupling. Choose the first migration to prove the method, not to be heroic. Budget for it as an operating cost, not a capital project, because that is what it is. And be honest about what should not move: a reporting tool used by four people in finance stays where it is. The payment path does not.