Rust Coreutils 0.12.0 Release: We are happy to announce the release of Rust Coreutils 0.12.0 - a release focused on compatibility fixes for our Ubuntu friends. Ubuntu ships uutils coreutils as its ...

TL;DR Researcher JoeCyberTech has published full details and a proof-of-concept for a critical uutils coreutils vulnerability, rated CVSS 9.9. The bug let a crafted translation file inject Rust code into the core utilities at build time. Maintainers fixed it in uucore 0.12.0. uucore's build script pasted Fluent translation text into a Rust raw string without proper escaping. A translation containing the two characters "# could close that string and turn the rest into compiled code.

In newer Ubuntu releases, such as Ubuntu 26.04 LTS Resolute Raccoon, you may have noticed that it uses the newer Rust Coreutils instead of the stable GNU Coreutils. Rust Coreutils ensures memory safety for all the core apps, such as ls, cp, and other essential commands. If you're trying to run an upgrade to all packages inside the Ubuntu proot-distro, you may have noticed that…

Cet article est un post-mortem de recherche offensive menée sur GNU Savannah, la forge logicielle hébergeant des projets GNU critiques comme Bash et Coreutils. La recherche a été conduite via la plateforme Hacktron et signalée à la FSF le 11 mai 2026. La forge utilise Savane, une application PHP héritée du code SourceForge de 2001.

Cross-platform Rust rewrite of the GNU coreutils. Contribute to uutils/coreutils development by creating an account on GitHub.

Treating / specially (GNU Coreutils 9.12)

At Build 2026 Microsoft announced two things that matter if you set up Windows machines for coding: **Windows Developer Configurations** , a one-command setup for a fresh dev box, and **Coreutils for Windows** , native builds of `ls`, `cp`, `grep` and friends. Both were announced as generally available. The setup is one line of PowerShell piped into `iex`. That is convenient, and it is also exactly the kind of command you should read before running on a machine you care about. So we read the repo docs and the scripts. Here is what actually happens, what changes on your machine, and the parts that could surprise you. ## TL;DR * `irm https://aka.ms/devconfig/standard/setup.ps1 | iex` installs about 18 packages with winget, changes Explorer, Start, search and theme settings, installs WSL with Ubuntu, and may restart your PC once. * **Standard** runs the bootstrap with `-Action Partial`. **Full** runs `-Action Full` and adds Developer Mode, Sudo, widgets off, two Edge policies and Remote Desktop. * The scripts verify Microsoft Authenticode signatures on everything they download, but `irm | iex` itself does not verify the small wrapper script. You can check it yourself first. * The uninstall script **permanently deletes the Ubuntu distro** without asking, and it removes the tools it manages even if you had them installed before. * Coreutils for Windows installs with `winget install Microsoft.Coreutils`. In PowerShell several commands clash with built-in aliases, which matters for scripts. ## The one-liners From the WindowsDeveloperConfig repo: # Standard experience irm https://aka.ms/devconfig/standard/setup.ps1 | iex # Full experience irm https://aka.ms/devconfig/full/setup.ps1 | iex # Uninstall (covers both) irm https://aka.ms/devconfig/standard/uninstall.ps1 | iex The aka.ms links redirect to `setup-standard.ps1`, `setup-full.ps1` and `uninstall.ps1` in the repo. Each wrapper is about 20 lines. It downloads `bootstrap.ps1` from a **pinned commit** , checks that the signer is Microsoft Corporation, and only then runs it with `-Action Partial`, `-Action Full` or `-Action Uninstall`. The repo is honest about the gap: "`irm | iex` does not verify the wrapper's own signature; it trusts the HTTPS endpoint." If you want to check the entry script too, download it and look before you run anything: $f = "$env:TEMP\setup-standard.ps1" Invoke-WebRequest https://aka.ms/devconfig/standard/setup.ps1 -OutFile $f Get-AuthenticodeSignature $f | Format-List Status, SignerCertificate notepad $f It is short enough to read in a minute, and it is a good habit for any `irm | iex` install, not just this one. ## What gets installed The Standard setup installs these with winget: Area | Packages ---|--- Shell and terminal | Windows Terminal, Intelligent Terminal, PowerShell 7, Oh My Posh Source control | Git, GitHub CLI Editors and AI | VS Code, GitHub Copilot CLI Runtimes | .NET SDK 10, Python 3.14 + uv, Node.js LTS + nvm for Windows Cloud | Azure CLI Utilities | Coreutils for Windows, Windows App CLI, PowerToys, Visual C++ Redistributable It then sets PowerShell 7 as the default Terminal profile, installs Cascadia Code NF and Cascadia Mono NF for all users, adds a GitHub Copilot profile to the Terminal dropdown, and installs WSL plus Ubuntu with `wsl --install -d Ubuntu --no-launch`. Practical numbers from the docs: roughly **30 minutes** on a clean machine, about **15 GB** of free disk space, **up to two UAC prompts** , and Windows 11 only. Windows 10 is not supported. ## What it changes on your machine This is the part worth reading twice. Some highlights from the documented registry changes and the "Known limitations" table: * **Explorer:** file extensions and hidden files shown, full path in the title bar, Explorer opens to This PC, no recent or frequent items in Quick Access. * **Start and search:** no web results in search, no Start recommendations, no search highlights. * **Notifications:** Do Not Disturb is turned on **globally** , not just for quiet hours, until you turn it back off. * **Theme:** dark mode for apps and the system. * **Long paths:** `LongPathsEnabled` set to `1`. * **Node:** both Node.js LTS and nvm for Windows get installed. The docs suggest uninstalling Node.js first if you want nvm to own the PATH entry. * **Your PowerShell profile:** an Oh My Posh block is added to `$PROFILE`. If the profile already has other initialization, setup leaves it alone and flags it. * **Terminal settings:** `settings.json` is round-tripped through JSON, so **comments are lost**. A `settings.json.bak` is written first. The **Full** setup adds more: * Developer Mode and Sudo (inline mode). * Widgets turned off through policy. * Two Edge settings written as policy, so Edge will say it is "managed by your organization". * **Remote Desktop allowed** (`fDenyTSConnections` set to `0`). The docs note the firewall rule is not opened, but it is still a change to the machine's security posture. What it does **not** do, per the docs: no telemetry, no sign-ins, no credential changes, no Windows Defender changes. Git and the GitHub CLI are installed but not configured, so you still need `git config user.name` and `gh auth login`. There is also no dry run (`-WhatIf`) and no switch to skip individual packages. If you want a different package list, the documented path is to clone the repo, edit the files under `src\windows-dev-config`, and run the unsigned source with `-AllowUnsigned`. ## The restart and the uninstall WSL needs virtualization, so setup may restart the machine. It warns you and **restarts after 10 seconds** , so save your work before you start. A scheduled task called `WindowsDevConfigResume` picks the run up after you sign back in. If nothing happens: Get-ScheduledTask -TaskName WindowsDevConfigResume Re-running the original one-liner is safe. Steps that are already done report `already OK` and are skipped. Logs go to `devconfig-log.txt` under `%ProgramData%\CalmOS`. The uninstall deserves a warning of its own. According to the docs it: * **Permanently deletes Ubuntu and its files** , without confirmation. * Removes the tools it manages, including copies you had installed before running setup. * Resets settings to defaults rather than restoring what you had before (themes go back to light, for example). If you have real work inside that Ubuntu distro, export it first: wsl --export Ubuntu D:\backup\ubuntu.tar ## Coreutils for Windows Coreutils for Windows is a Microsoft-maintained build of the Rust uutils projects (coreutils, findutils and grep), shipped as one multi-call binary. It is MIT licensed and has x64 and ARM64 builds. The current release at the time of writing is `v2026.9.3`. The Standard setup installs it, or you can install it alone: winget install Microsoft.Coreutils Then the usual pipelines work in CMD and PowerShell: grep -rn "TODO" src | wc -l find . -name "*.log" -mtime +7 A few things we would want to know before relying on it in scripts: * **PowerShell 7.4 or later is required** , and 7.6 or later is recommended for `~` support. * **Alias clashes.** In PowerShell, `cat`, `cp`, `ls`, `mv`, `pwd`, `rm`, `sleep`, `sort`, `tee` and others share names with built-in aliases. The installer hooks into PSReadLine to rewrite what you type interactively, but it does not remove the aliases. Check what a name resolves to with `Get-Command ls -All`. * **Some commands are not shipped** because they clash with Windows built-ins or need POSIX features: `dir`, `more`, `whoami`, `kill` and `timeout` among them. `chmod`, `chown` and `uname` are dropped too. * **No`/dev/null`.** Use `NUL`, as in `find . -name "*.log" > NUL`. * **CRLF line endings** can still trip byte-oriented tools like `uniq`. * You can turn off individual utilities with `coreutils-manager disable <utility name>`. One detail that may confuse you: the Build blog calls Coreutils generally available, but the repo README still says "This project is in preview." Treat it like any young tool and test your scripts before switching a team over. ## Our take For a brand new machine or a throwaway VM, the Standard setup is a sensible default, and the signing and pinned-commit design is better than most `irm | iex` installers. On a machine you already use every day, we would read the settings list first, skip Full unless you actually want Remote Desktop and Edge policies, and back up WSL before you ever touch the uninstall script. Have you tried Windows Developer Config or Coreutils for Windows on a real machine yet? Did it save you time, or did it change something you had to undo? And would you trust a one-line setup script on your main dev box, or only on a fresh VM? _We first wrote about the Build 2026 developer announcements on Windows Mode._

Ubuntu 26.10 rilis dengan coreutils berbasis Rust, Linux 7.3 final, dan Fedora 45 molor ke 27 Oktober. Apa yang perlu kamu tahu.

Which uutils commands behave differently from GNU coreutils on Ubuntu 26.04 and 26.10, tested on 567 commands: mkdir locks, mv and mtime, timeout, date and DST, df, chown. How to check which you have and how to use GNU instead.