news
Attack Path Found in APT, Patch Available
-
GamingOnLinux ☛ Debian, Ubuntu and derivatives hit by APT flaw that could give attackers root access | GamingOnLinux
Got root? Someone else might have on your system - if you're running Debian, Ubuntu and derivatives you'll want to get updating soon. Canonical revealed CVE-2026-109518 on November 4th which has a "High" priority.
-
QSB-122: Package verification bypass in APT (DSA-6607-1)
We have published Qubes Security Bulletin (QSB) 122: Package verification bypass in APT (DSA-6607-1). The text of this QSB and its accompanying cryptographic signatures are reproduced below, followed by a general explanation of this announcement and authentication instructions.
-
CSO ☛ Debian, Ubuntu patch APT flaw that could hand attackers root
A vulnerability in Debian and Ubuntu’s package manager could let network attackers replace verified software with malicious packages and execute code as root.
-
SQ Magazine ☛ Debian and Ubuntu Patch APT Flaw That Hands Attackers Root
Debian and Ubuntu shipped fixes on November 4 for CVE-2026-109518, an APT flaw that lets network attackers swap a package after it passes verification. The tampered package’s scripts then run as root on the target machine.
-
Debian and Ubuntu APT CVE-2026-109518: Package Swap to Root — Prepare Now
APT developers: "critical file verification bypass". Ubuntu (Canonical): priority High, CVSS v4.0 base score 7.7. KEV status: CVE-2026-109518 is not in CISA's KEV catalog (catalog version 2026.11.03).
Added late:
-
Debian and Ubuntu Patch APT Flaw That Hands Attackers Root
Debian and Ubuntu shipped fixes on November 4 for CVE-2026-109518, an APT flaw that lets network attackers swap a package after it passes verification. The tampered package’s scripts then run as root on the target machine.
Also here:
-
Careful with “apt upgrade”: hackers can swap verified packages and deliver malware
An attacker sitting between a Linux system and its package mirror can exploit a severe APT flaw to swap legitimate packages, even after the validation that they are safe. Debian and Ubuntu have released security updates.