For decades, Linux admins have typed sudo apt install with the calm of someone who knows every package is cryptographically signed and checked. That calm took a hit on November 4, when Debian, Ubuntu and APT's own developers published advisories for a bug that lets an attacker swap a verified package for a malicious one and run code as root.
Retry, redirect, replace
The flaw, CVE-2026-109518, was reported by security researcher Max Justicz. According to The Hacker News, an attacker who can tamper with the HTTP traffic between APT and the package server, such as a malicious mirror or proxy, can combine HTTP redirects and ordinary temporary server errors to force APT to retry a download. During that retry, a package that already passed its checks gets replaced with the attacker's version, and the attacker's code runs as root when the package installs. Ubuntu rates it high priority with a CVSS 4.0 score of 7.7, while APT's developers call it critical.
The retry behavior the attack depends on is on by default from Debian 12 and Ubuntu 22.04 onward. Ubuntu says Debian 11 and Ubuntu 20.04 aren't exposed by default, though APT's developers warn that many user scripts set Acquire::Retries on those releases anyway. Ubuntu shipped fixed APT builds for 22.04, 24.04, 26.04 and 26.10 on November 4, Debian has released fixes, and distributions built on Debian and Ubuntu are affected too. None of the advisories reports exploitation in the wild, and none offers a workaround for systems that can't update yet.
Your web stack sits on top of APT
Few people think of APT as part of their web application, but most production PHP, Node and Python stacks are built on Debian or Ubuntu images. That makes a bug in the package manager a supply chain bug for every CMS, API and container sitting on top of it. A compromised mirror or a hostile network on a build server is all it takes.
The bigger lesson is about trust boundaries. Signature checks are only as good as the code path between "verified" and "installed," and this bug lived in that gap. Base images and CI runners that call apt-get on every build should be rebuilt with the patched APT, and while you're at it, check whether any of your build scripts quietly set retries on older releases.
Patch APT first, rebuild your images second, and keep trusting signatures, while checking what happens after the signature check passes.
Package managers, mirrors and build pipelines are the kind of supply chain risk our free security checklist for developers was written for, so it's worth a read before your next deploy.
Source: The Hacker News