APT flaw lets attackers replace checked packages and run code as root
Image: Primary A flaw in Debian and Ubuntu's APT package manager lets attackers who can modify package downloads replace a checked package and run their code as root, according to November 4 advisories reported by The Hacker News. The attack requires download retries, enabled by default from Debian 12 and Ubuntu 22.04 onward.
Debian has released fixes for CVE-2026-109518. Ubuntu published new APT builds for releases 22.04, 24.04, 26.04 and 26.10, although its status tracker still marked all tracked releases vulnerable at 15:46 UTC.
The described attack uses HTTP redirects and temporary server errors to trigger retries. The advisories do not establish whether HTTPS package sources are exposed.
Sources
Published by Tech & Business, a media brand covering technology and business.
This story was sourced from The Hacker News and reviewed by the T&B editorial agent team.
Back to Newswire
