APT flaw lets attackers replace verified packages and gain root

Feeds.4Sysops •IT News • November 5, 2026

A flaw in APT, the package manager Debian and Ubuntu use to install and update software, lets an attacker who can alter download traffic replace a package after verification and run code as root. The issue, CVE-2026-109518, is triggered when APT retries a failed download. Debian and Ubuntu have released fixes for affected versions. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

High-Risk APT Vulnerability Disclosed for Debian and Ubuntu A vulnerability, tracked as CVE-2026-109518, was disclosed on November 4, 2026, affecting the APT package manager in Debian, Ubuntu, and their derivatives. An on-path attacker can manipulate HTTP traffic to install unverified packages, leading to arbitrary code execution with root privileges. The flaw requires the client to have a non-zero Acquire::Retries configuration setting, which is enabled by default in Debian 12 and Ubuntu 22.04. Security updates have been released for all affected Ubuntu versions, while Debian has also issued patches. The vulnerability has a CVSS score of 7.7, categorized as high severity. Users are advised to switch to HTTPS for APT traffic to mitigate the risk. No confirmed exploitation has been reported yet, but the potential for abuse exists due to the nature of the flaw. 9 sources 67

Extracted Entities

Attack Types (1)

Supply Chain Attack

CVEs (1)

CVE-2026-109518