Ubuntu 26.10 moves cp, mv and rm to Rust coreutils

Ubuntu 26.10 replaces cp, mv and rm with their Rust implementations, which finishes a switch the distribution started a year ago. Phoronix reports that these were the last three GNU commands left, and that the compatibility problems holding them back have been fixed upstream in uutils. The stable release is expected on October 15, 2026.

These three commands are the ones your scripts call most. That makes this the release where a quiet behavior difference is most likely to show up in something you already run.

What moved, and what already had

The earlier releases did the easier part. OMG! Ubuntu reports that Ubuntu 26.10, codenamed Stonking Stingray, now ships a full set of Rust core utilities, including ls, cat, chmod and du alongside the three new arrivals.

Ubuntu 25.10 was the first release to ship the Rust utilities, and it also made sudo-rs the default tool for privilege escalation, according to It's FOSS. Coreutils are the small programs that do a Unix system's everyday work: copying files, listing directories, changing permissions. The uutils project is rewriting them in Rust. Rust prevents whole classes of memory bugs at compile time.

The project's stated goal is that you should not notice. The uutils versions aim to be drop-in replacements, and treat any divergence from GNU behavior as a bug.

Why cp, mv and rm waited

They were pulled from Ubuntu 26.04 LTS over a specific class of flaw. OMG! Ubuntu and It's FOSS both report TOCTOU problems in the uutils versions. TOCTOU stands for time-of-check to time-of-use: the program checks a file, then acts on it, and an attacker changes the file in the gap between those two steps.

Canonical commissioned the security firm Zellic to audit the codebase. It's FOSS reports the audit ran in two rounds between December 2025 and March 2026, found 113 issues, and that 44 of them were assigned CVE numbers. It also reports the vast majority have since been resolved.

Item	Detail
Release	Ubuntu 26.10, Stonking Stingray
Moving now	cp, mv, rm
Already moved	ls, cat, chmod, du, and sudo-rs since 25.10
Audit	Zellic, two rounds, Dec 2025 to Mar 2026: 113 issues, 44 CVEs
Revert path	Install the coreutils-from-gnu package
Dates	Beta later in September 2026, stable October 15, 2026

That audit history is the reason to treat this as a real change rather than a cosmetic one. A rewrite of the commands that delete and move files got 44 CVEs before shipping. That is a reassuring sign that someone looked. It is also a reminder that these are not trivial programs.

What this means for developers

Test the scripts that run as root first. These three commands sit inside package postinstall steps, backup jobs and deployment scripts. In those places a missing flag or a changed exit code breaks a machine, rather than printing a confusing message. It's FOSS notes some Rust options may still be missing or behave differently from their GNU counterparts, so the assumption to check is your own flags, not the common cases.

There is a documented way out, and it takes one package. Installing coreutils-from-gnu puts the GNU versions back. Pin that in your image build if you need a release where nothing about these commands changed, and treat it as a rollback plan rather than a permanent position.

Your CI images are the place this reaches you before your laptop does. An interim release like 26.10 is not what most production fleets run, but it is what a lot of container base images and test runners track. A pipeline that quietly depends on GNU behavior will fail there first, which is the cheapest place to find out.

The 26.04 LTS timing is the part worth watching. These commands were held back from the LTS, so the fixes landing now are what a future LTS inherits. This is the same direction of travel as Rust becoming a tier-1 language at Microsoft and Mold's Rust rewrite aiming to be Linux's default linker. The rewrites are landing in the parts of a system nobody chooses to use.