Security AlertCritical
Debian and Ubuntu fix APT flaw that can turn package installs into root code
Nov 4, 2026 · Summarized by Fundy Tech from The Hacker News
The 30-second version
A flaw in APT can let a man-in-the-middle attacker swap a verified package and run code as root. Debian and Ubuntu published fixes on November 4.
Key points
- CVE-2026-109518 affects APT on Debian and Ubuntu.
- The attack needs APT to retry failed downloads.
- Debian, Ubuntu and APT developers published advisories on November 4.
- Ubuntu says some older releases are not exposed by default.
Why it matters
If you manage Linux systems, package updates themselves could be a route to compromise if traffic is intercepted. This is important for servers, office PCs and home Linux machines that rely on Debian or Ubuntu packages.
Who’s affected: Debian and Ubuntu systems using APT
What to do
- Update APT on Debian and Ubuntu systems.
- Check whether retry settings were enabled in scripts.
- Review package download paths and mirror settings.
Vulnerability IDs
Original reporting
Not sure if this affects you?
Fundy Tech helps businesses and households across Atlantic Canada stay patched, protected and up to speed. Tell us what you’re running and we’ll tell you straight whether you need to act.