Security · 5 November 2026
APT flaw lets MITM swap verified Debian/Ubuntu packages and execute as root
A vulnerability in APT (CVE‑2026‑109518) allows attackers who can modify package downloads to replace verified packages, running code as root; the exploit relies on APT’s default retry behavior from Debian 12 and Ubuntu 22.04 onward. Fixed versions have been released (Debian 2.2.5, Ubuntu updates pending) and the flaw is rated high priority with a CVSS 7.7 score.
Why it matters
Plan immediate patch rollout for affected Debian and Ubuntu customers; delayed updates increase breach risk.
For product managers
For your product
What does this mean for your product?
Try it on your product More from this issueAll AI news from 5 Nov →
Get this every morning, written for your product.
Deltaday reads the whole AI news cycle and tells you what changed, whether it's real yet, and what to do about it.