APT
ProductAm I affected?
Checked against NVD affected-version data on our server. Nothing you type is stored.
Security timeline
- Vulnerability reported by The Hacker NewsDebian and Ubuntu APT flaw lets attackers swap verified packages and run code as root
- Vulnerability reported by Cyber Security NewsDebian APT flaw CVE-2026-109518 lets attackers hijack updates and run code as root
Recent news
Debian and Ubuntu APT flaw lets attackers swap verified packages and run code as root
A flaw in APT, the package manager used by Debian and Ubuntu, allows a man-in-the-middle attacker who can modify package downloads to substitute a package that has passed verification with a malicious one. The injected code runs as root. The attack depends on APT retrying failed downloads, which the article says it does by default from Debian 12, and advisories from Debian, Ubuntu and the APT developers were published on 4 November.
Debian APT flaw CVE-2026-109518 lets attackers hijack updates and run code as root
CVE-2026-109518 is a flaw in APT that can let a man-in-the-middle replace a verified package during an interrupted, redirected download, leading to code execution as root. It requires the attacker to sit on the network path and APT's Acquire::Retries setting to be above zero, which is 3 by default on Debian 12 and Ubuntu 22.04 LTS. Debian's fixes are APT 2.6.2 for bookworm and 3.0.4 for trixie, and Ubuntu and other derivatives need their own patches.