By ByteBot
Rust just cracked the TIOBE Programming Community Index top 10 for the first time in the language’s history — jumping from #18 to #10 in a single year, in the index’s 25th anniversary edition. After nine straight years of being developers’ most-loved language and a near-decade of “you should really learn Rust” discourse, it’s finally becoming a mainstream one. The interesting part: this didn’t happen because developers started loving Rust more. It happened because governments and enterprises decided C and C++ are security liabilities.
The Numbers
Rust landed at #10 with a 1.34% TIOBE rating — modest in absolute terms, but historic in context. The TIOBE Index, which measures programming language popularity based on search engine activity across 25 platforms, has its top 10 dominated by languages with 20 to 40 years of history. Three of today’s top five (C, C++, Java) were already leaders when TIOBE launched in 2001. Rust’s stable release was 2015. That’s 11 years to crack a list that typically takes decades to enter.
The full July 2026 top 10: Python (18.94%), C (10.86%), C++ (9.12%), Java (8.03%), C#, JavaScript, Go, SQL, R — and now Rust at #10. TIOBE CEO Paul Jansen put it plainly: “Rust’s growing popularity can largely be attributed to its strong focus on memory safety while still generating extremely fast code.”
Why Now — It’s Not the Developers
Rust has ranked as the most-admired or most-loved language in the Stack Overflow Developer Survey for nine consecutive years. Developer enthusiasm has never been the bottleneck. The TIOBE jump is being driven by something else entirely: regulatory and institutional pressure.
In June 2025, CISA and the NSA issued joint guidance requiring vendors supplying critical infrastructure to eliminate memory safety risks by 2026 — or publish an actionable roadmap explaining when they will. The White House Office of the National Cyber Director went further, naming Rust explicitly as the recommended memory-safe systems language. That memo doesn’t carry the weight of law, but it carries the weight of procurement. CISOs and government contracting officers started asking vendors about memory safety plans. Suddenly Rust wasn’t just a better language — it was a compliance checkbox.
At the kernel level, Rust stopped being experimental. In December 2025, the Linux kernel officially accepted Rust as a non-experimental component. Android 16 ships with the ashmem memory allocator written in Rust. Google has reported zero memory safety bugs from the Rust-based kernel code deployed so far — a stark contrast to equivalent C drivers that accumulated CVEs.
Who’s Already Shipping Rust in Production
The enterprise adoption picture isn’t theoretical. Meta has rewritten WhatsApp’s media library in Rust and is midway through rewriting its core mobile messaging infrastructure — Facebook, Messenger, Instagram, and VR — after describing the existing C codebase as “spaghetti.” Microsoft is systematically rewriting Windows kernel components; 70% of Microsoft’s historical CVEs were memory safety issues. AWS Firecracker, the microVM sandbox that powers Lambda, was written in Rust and now handles trillions of requests monthly. ByteIota covered the full enterprise migration story.
According to the 2025 State of Rust Survey, 48.8% of organizations now make non-trivial use of Rust — up from 38.7% in 2023. Among those already running Rust in production, 84.8% say it helped them achieve their goals and 78.5% say the adoption was worth the cost. These aren’t Rust evangelists — these are engineering teams with budget accountability.
What Happens to C and C++
C holds #2 at 10.86% and C++ sits at #3 with 9.12%. Neither is going anywhere. Existing codebases, game engines, embedded firmware, and automotive software will run on C and C++ for another generation. But approximately 70% of critical security vulnerabilities in large C and C++ codebases are memory-safety issues — a fact that becomes harder to defend as governments make it a compliance matter.
The shift is happening at the edges, where new things are built. New greenfield infrastructure — networking stacks, container runtimes, observability tools — is increasingly defaulting to Rust. Rust isn’t inheriting C++’s existing jobs. It’s taking all the new ones.
What This Means for Your Career
Rust developer job postings have more than doubled in the past two years. Salaries run $80,000 to $130,000 depending on experience, with a notable talent shortage across fintech, cybersecurity, cloud infrastructure, and embedded systems. The skill gap between demand and supply is the widest it’s been.
The learning curve remains real — expect six months to reach productive proficiency — but it’s softer than it used to be. AI coding tools have gotten genuinely good at explaining borrow checker errors. What used to require a deep Stack Overflow dive now takes 30 seconds with GitHub Copilot or Claude. If you’re interested in starting, the official Rust Book is the best entry point, paired with rustlings exercises for hands-on practice.
The Real Signal
A TIOBE ranking measures search volume, not code deployed. It’s a lagging indicator of where developer attention is going, not a census of production systems. But that’s exactly what makes Rust’s entry significant. TIOBE captures the moment a language escapes its niche and enters the general conversation — tutorials getting written, courses being published, job postings appearing on LinkedIn. That’s where Rust is now.
Nine years of “most loved” status reflected what developers thought about Rust. This TIOBE milestone reflects what enterprises, governments, and hiring managers are doing about it. That’s a different signal entirely — and a more durable one.
