Debian and Ubuntu APT Flaw Lets MitM Attackers Swap Verified Packages and Run Code as Root
Read original article ↗AI Summary
A critical vulnerability in APT, the package manager used by Debian and Ubuntu, allows man-in-the-middle (MitM) attackers to swap verified packages with malicious ones during download retries, leading to arbitrary code execution as root. The flaw, CVE-2026-109518, affects systems where APT retries failed downloads—a default behavior in Debian 12 and Ubuntu 22.04 and later. Attackers can exploit HTTP redirects and temporary server errors to trigger retries and substitute packages, provided they can intercept or modify HTTP traffic, such as through a compromised mirror or proxy. Fixed versions have been released for multiple Debian and Ubuntu versions, but older or long-term supported releases may still be vulnerable if retry settings are enabled.
AI-extracted · verify before operational use
No entities or IoCs were extracted from this article.