Debian APT flaw lets attackers hijack updates and run code as root
Original title: Debian APT Flaw Lets Hackers Hijack Software Updates and Execute Code as Root
CVE-2026-109518 in APT allows network attackers to replace verified packages and execute code as root on Debian releases.
A flaw in Debian's APT package manager lets an attacker on the network swap a trusted package for a malicious one after an HTTP redirect. The attack can result in root code execution. Debian announced the issue on November 4, 2026 and credited researcher Max Justicz. APT checks packages against signatures but mishandles merged downloads after redirects, creating a window for replacement. The attacker must intercept traffic and follow redirects. Default retry setting of 3 is required. Vulnerable versions include Bookworm before 2.6.2, Trixie before 3.0.4 and Testing before 3.3.6. Fixed in 2.6.2 and 3.0.4. No active exploitation reported.
- Bookworm vulnerable before 2.6.2, fixed in 2.6.2
- Trixie vulnerable before 3.0.4, fixed in 3.0.4
- Attack requires redirect following and retry
- Similar 2019 redirect flaw existed
Impact: package replacement leading to root code execution via MITM
- 1.Upgrade APT to 2.6.2 or 3.0.4
- 2.Set Acquire::Retries to 0
- 3.Use only trusted mirrors
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-109518 | Man-in-the-middle RCE in APT on Debian and Ubuntu | 7.7 | <1% | PoC ×2 |
From the original article
3 min read at cybersecuritynews.com
A newly disclosed bug in APT, the package manager behind Debian and Ubuntu, can let a network spy swap a trusted software package for a bad one. The flaw is tracked as CVE-2026-109518 and can end in code running with root rights, the highest level of control on a Linux system. Debian announced the issue […]
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.