On November 4, Debian, Ubuntu and APT’s developers disclosed a critical flaw in APT, their package manager, that can let an attacker who alters package-download traffic replace a checked package and run code as root (CVE-2026-109518). Max Justicz reported the flaw.
APT normally checks a package after downloading it, but a failed download can trigger a retry. By using HTTP redirects and temporary server errors to force that retry, an attacker who can change the HTTP exchange can substitute a different package; installation runs that package’s code with root privileges. Retries are enabled by default in Debian 12 and Ubuntu 22.04 and later.
Debian and Ubuntu say older releases are not vulnerable by default, but scripts may have enabled APT’s Acquire::Retries setting. Debian had fixes available, while Ubuntu updates were still rolling out; Debian testing remained vulnerable at the time reported, and the advisories described no attacks in the wild. For Debian- or Ubuntu-derived fleets, default settings alone do not settle exposure, and the reports did not identify which downstream distributions had fixed the issue.
Debian, Ubuntu patch APT flaw that could hand attackers root
A vulnerability in Debian and Ubuntu’s package manager could let network attackers replace verified software with malicious packages and execute code as root.