Debian and Ubuntu APT Flaw Lets MitM Attackers Swap Verified Packages and Run Code as Root

Summary: A flaw in APT, the package manager for Debian and Ubuntu, lets an attacker who can modify package downloads swap a checked package for their own, and the attacker's code then runs as root, according to advisories Debian, Ubuntu, and APT's developers published on November 4. The attack requires APT to retry failed downloads, which it does by default from Debian 12 and Ubuntu 22.04 onward, and Debian has released fixed versions for CVE-2026-109518 while Ubuntu rates the flaw high priority with a CVSS 4.0 score of 7.7.
Key Takeaway: Anyone who can alter HTTP traffic between APT and the package server, including a malicious mirror or proxy, can get code running as root on the machine, and at 15:46 UTC on November 4 Ubuntu still marked all eight releases it tracks, from 14.04 LTS to 26.10, as vulnerable.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-109518
Related: ⚡ Weekly Recap: SSHole Exploited, APT Root RCE, Robot Takeovers, 15K Hacked Sites, and More Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026