A high-priority vulnerability in APT, tracked as CVE-2026-109518, allows network-level attackers to substitute verified packages and execute code as root.
The issue impacts Debian and Ubuntu systems utilizing default download retry configurations.
Official advisories and patched builds have been published.
The problem concerns the mechanism these systems use to download and install programs. According to announcements published on November 4, 2026 by the software creators and the people responsible for Debian and Ubuntu, the attack can occur when someone has control of the internet connection between the computer and the update server, such as through a malicious middleman.
How can the surgery be performed?
When the system tries to download an update and the download fails, the computer is set to automatically retry. By exploiting this process, someone with access to the connection can trick the computer into accepting a fake file instead of the genuine one.
This automatic download retry is enabled by default in newer versions, such as Debian 12 and Ubuntu 22.04 and later. Older versions, such as Debian 11 and Ubuntu 20.04, are not exposed by default unless users have manually enabled the relevant setting.
The corrections and the reaction of the companies
Ubuntu has declared the issue a high priority and noted that Debian and Ubuntu-based software distributions are also affected. The developers have quickly released new releases that fix the issue, including new builds for Ubuntu 26.10, 26.04 LTS, 24.04 LTS, and 22.04 LTS, as well as a patch for Debian 11.
↳
READ ALSO
HACKS.GR / RELATED
Vulnerabilities & Security Updates
Serious security flaws in Xen software allow access to other machines' memory
↗
So far, no actual attacks have been identified as being in progress, nor are there any instructions for a temporary solution, while it remains unknown whether software sources that use encrypted connections are affected. The problem was discovered by researcher Max Justicz.
>Stay connected with Hacks.gr
Set us as a preferred source on Google and find us on social media.
Preferred source
↗
end of article
