A flaw in APT — the package manager at the heart of Debian and Ubuntu — lets an attacker who can modify package downloads (a malicious mirror, proxy or network position) swap a verified package for their own, with the attacker's code then executing as root. Tracked as CVE-2026-109518, the flaw exploits APT's default behaviour of retrying failed downloads (default since Debian 12 and Ubuntu 22.04) using HTTP redirects and temporary server errors; an attacker can redirect APT to a malicious package during the retry. Ubuntu rates the flaw high priority at CVSS 4.0 score 7.7, while APT's developers label it critical. Fixed versions were published on 4 November: Ubuntu builds for 26.10, 26.04 LTS, 24.04 LTS and 22.04 LTS (plus Ubuntu Pro for 14.04), and Debian 2.2.5 for 11 plus fixed builds for 12 and testing. Older releases (Debian 11 default, Ubuntu 20.04) are not exposed unless administrators enabled the Acquire::Retries setting. Max Justicz reported the flaw; no in-the-wild exploitation has been publicly documented, and no workaround exists for systems that cannot update.

• Source article