CISA: Most critical open source projects not using memory safe code

**Executive summary:** A joint CISA/FBI/ASD/CCCS analysis of 172 critical open-source projects found that over half contain memory-unsafe code (52% of projects, 55% of total lines), with major projects like Linux, Tor, Chromium, MySQL, glibc, and Redis showing high ratios; the report recommends adopting memory-safe languages, auditing dependencies, and applying continuous testing (static/dynamic analysis and fuzzing) to reduce memory-safety vulnerabilities.