# APT flaw lets attackers replace checked packages and run code as root

_Published Wednesday, November 4, 2026 at 3:45 PM EST · Security, Infrastructure · Latest · Tier 1 — Major_

![APT flaw lets attackers replace checked packages and run code as root — Primary](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgUPaNgRQEg3TU6-9BBgKse77CGVpbBFbn48cBnN1aanKvaMzk_mT74RxyWZA3_NbcrYe0UnRAQlELRYKGiGNrLUDcBMSKXFgRNxaND7RoaVFOs1Q7rkFFtlpoAzYQ7C8i6RAY4bNNTarEMUI-iFR4A_IfjIkFE9vpyQjG-0QFngy5cRE8f2GhGfTltkaI/s1700-nu-rw-lo-l85-e365/linux-apt.jpg)

A flaw in Debian and Ubuntu's APT package manager lets attackers who can modify package downloads replace a checked package and run their code as root, according to November 4 advisories reported by The Hacker News. The attack requires download retries, enabled by default from Debian 12 and Ubuntu 22.04 onward.

Debian has released fixes for CVE-2026-109518. Ubuntu published new APT builds for releases 22.04, 24.04, 26.04 and 26.10, although its status tracker still marked all tracked releases vulnerable at 15:46 UTC.

The described attack uses HTTP redirects and temporary server errors to trigger retries. The advisories do not establish whether HTTPS package sources are exposed.

## Sources

- [The Hacker News](https://thehackernews.com/2026/11/debian-and-ubuntu-apt-flaw-lets-mitm.html)

---
Canonical: https://techandbusiness.org/newswire/oaXO0BTRkKgA5TmiCosDW5
Published: 2026-11-04T20:45:35.713Z
Story chronology: 2026-11-04T17:00:00.000Z
Retrieved: 2026-11-04T22:59:02.500Z
Publisher: Tech & Business (techandbusiness.org)