Debian and Ubuntu APT Flaw Lets MitM Attackers Swap Verified Packages and Run Code as Root Swati KhandelwalNov 04, 2026Linux / Vulnerability A flaw in APT, the package manager for Debian and Ubuntu, allows an attacker who can modify package downloads to swap a checked package for their own. The attacker's code then runs as root, according to advisories that Debian, Ubuntu, and APT's developers published on November 4. The attack needs APT to retry failed downloads, which it does by default from Debian 12 and Ubuntu 22.04 onward. Debian has released fixed versions of APT for the flaw, CVE-2026-109518. APT's developers, who call the flaw critical, say updates for Ubuntu and its Ubuntu Pro subscription service are being released. Ubuntu 14.04 users with Ubuntu Pro can already get one. Older releases, such as Debian 11 and Ubuntu 20.04, are not exposed by default, according to Ubuntu. But many user scripts may have turned on the retry setting, Acquire::Retries, on those releases anyway, APT's developers say. Debian's testing branch was still on the vulnerable version 3.3.5 at 14:58 UTC on November 4. For Debian 11, whose Debian long-term support ended on August 31, APT's developers have published a fixed version, 2.2.5. Ubuntu rates the flaw as high priority, with a CVSS 4.0 score of 7.7, and says that distributions built on Debian and Ubuntu are affected as well, without naming any. Ubuntu published new APT builds for four of its releases to its security archive at 14:25 UTC on November 4: At 15:46 UTC, Ubuntu still marked all eight releases it tracks for the flaw, from 14.04 LTS to 26.10, as vulnerable. The attacker can be anyone who can change the HTTP traffic between APT and the package server, including a malicious mirror or proxy, according to Ubuntu. The attack runs when the computer installs a package. The attacker uses HTTP redirects and ordinary temporary server errors to make APT retry the download, APT's developers say. Max Justicz reported the flaw. None of the three advisory reports describe attacks exploiting the flaw or offer a workaround for systems that cannot update yet. They describe the attack over HTTP and do not say whether package sources reached over HTTPS are exposed. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. linux, Software Security, Supply Chain, Vulnerability Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor TeamViewer Flaw Lets Remote Computers Attack Users Who Connect to Control Them The Rise of the Threat Operator: How AI Will Redefine Security Operations and Careers Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions Anthropic's Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers GoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session Decryption ThreatsDay: Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token Theft + 26 More Stories Why Urgent Security Fixes Aren't Fixed. Observe, Prove, Act, Confirm Gets Them Moving AI-Generated Fake Login Pages Are Making Account Takeovers Easier Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls CyberStrikeAI Uses 44 AI Agents to Automate Hacking Operations Against Japan Targets Critical 16-Year-Old UEFI Flaw Can Run Code Before Secure Boot on Network-Booting Servers Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw Chinese Hackers Use AI-Powered ARTEX to Target Over 200 Organizations Worldwide Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations American Organizations Under Attack: Skyw4lker Device Code Phishing Campaign Exposed Assess Your Organization's AI Code Sprawl Exposure With This Practical Guide Detect Lateral Movement and Evasive Attacks With Corelight's Open NDR Platform Beyond CVE Scanning: Book a Demo of Continuous AI-Powered Web Pentesting See How Bitdefender GravityZone Identifies Shadow AI and Prioritizes Endpoint Risks Your SOC Has an Identity Blind Spot. Here's How to Fix It Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities. Join the Experts Roadmap for AI-Ready Security Operations Evaluate Attack Surface Visibility With an AI Threat Readiness Framework Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar. Governance Sets the Ceiling on Your AI Security Program See the five moves that raise a Stage 2 Govern score to a defensible Stage 3. Uncover Identity Dark Matter: SACR Research Brief Eliminate the blind spots undermining your security. Download the SACR brief. BeyondTrust an 8X Gartner® Magic Quadrant™ Leader for PAM Gain clarity on the PAM market and understand why BeyondTrust is again a Leader. 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. PEDM vs. Standing Elevated Privileges: Control Access Without Flooding the Helpdesk Your Attack Surface Is Growing Faster Than Your Team Can Respond The MSP Margin Math Nobody's Doing: Your Next Technician Might Already be on Payroll Why Root and Jailbreak Detection Alone Cannot Guarantee Mobile App Security