CVE-2026-109518

🚨 BREAKING: A flaw in APT, the tool that installs software on Debian Linux, lets an attacker on the network tamper with a package after it passes verification and run code as root. The bug, CVE-2026-109518, sits in resumed HTTP downloads. APT can merge two different downloads when a redirect gives them the same address, and a man-in-the-middle can then alter the file after its check. Debian fixed it in apt 3.0.4, shipped to Debian 13 security updates on 4 November. Users should upgrade now. Per Debian's changelog, the fix is four words long. "Open target files exclusively."

Fixes are available for CVE-2026-109518, a High severity vulnerability in APT, the package manager used in Debian, Ubuntu, and derivative Linux distributions. The CVE has a CVSS 4.0 score of 7.7. Remediation details are available on our blog. https://ubuntu.com/blog/apt-vulnerability-fixes-available https://t.co/ocIkYASiIQ

I used an AI for two hours and found a zero-day that would let a nation-state hack any server running stock Ubuntu. It was patched this morning. CVE-2026-109518. 🧵

‼️ A new Linux APT flaw in Debian and Ubuntu could let MitM attackers swap already-verified packages and execute code as root. Tracked as CVE-2026-109518, it affects default Debian 12+ and Ubuntu 22.04+ setups. Patches are rolling out. Details ↓ https://thehackernews.com/2026/11/debian-and-ubuntu-apt-flaw-lets-mitm.html

Fallo en APT de Debian y Ubuntu permite ejecutar código como root Se ha detectado un fallo de seguridad (CVE-2026-109518) en APT , el gestor de paquetes de Debian y Ubuntu https://blog.elhacker.net/2026/11/fallo-en-apt-de-debian-y-ubuntu-permite.html

Fixes are available for CVE-2026-109518, a High severity vulnerability in APT, the package manager used in Debian, Ubuntu, and derivative Linux distributions. The CVE has a CVSS 4.0 score of 7.7. Remediation details are available on our blog. https://ubuntu.com/blog/apt-vulnerability-fixes-available https://t.co/BXYEdkXkI0

🎯Debian、Ubuntu的软件包管理器APT存在高危漏洞 CVE-2026-109518。能操控系统与归档服务器之间 HTTP 通信的路径攻击者，获得 root 权限。 最新已修复的APT版本号如下： Ubuntu22.04：已在2.4.15版本中修复 Ubuntu24.04：已在2.8.4版本中修复 Ubuntu26.04：已在3.2.1版本中修复 Debian12：已在2.6.2版本中修复 Debian13：已在3.0.4版本中修复 目前可在线更新修复，进入SSH运行如下代码升级即可： ✅Root模式下，运行 apt --version 查看版本号，如果低于上述对应系统版本号，执行 apt update && apt install apt 进行升级！更新后运行 apt --version 查看最终版本号是否为修复版本即可。 甬哥以甲骨文VPS的ubuntu 22.04系统为例。 操作视频如下：

🚨 Otra vulnerabilidad crítica llega a Debian. Esta vez se trata de un fallo en APT, la herramienta que instala los paquetes en Debian. El fallo permite que un atacante ejecute código como root en tu servidor. Es el CVE-2026-109518 y Debian lo corrigió hoy, 4 de noviembre, con apt 3.0.4 para Debian 13 y 2.6.2 para Debian 12. No basta con lanzar una petición desde internet. El atacante necesita estar en el camino de la red: un proxy, una red comprometida o una red wifi pública. Si tienes un VPS con Debian que se actualiza solo por HTTP, es justo el escenario que describe el fallo. Estas son 3 cosas que puedes hacer ahora mismo: ➡️ Actualiza con apt update && apt upgrade. ➡️ Comprueba la versión instalada con apt policy apt (3.0.4 o superior en Debian 13, 2.6.2 o superior en Debian 12). ➡️ Cambia tus fuentes en /etc/apt/sources.list a mirrors con HTTPS.

【注意 ⚠️】Linux 核心套件管理工具 APT（Advanced Package Tool）爆出嚴重安全性漏洞（CVE-2026-109518）。攻擊者可透過中間人攻擊（MitM）手法竄改封包下載過程，將已通過數碼簽署驗證的正常軟體套件替換為惡意程式，進而以 Root 最高權限執行任意程式碼，波及 Debian、Ubuntu 及其眾多衍生發行版。Debian 與 Ubuntu 官方已緊急釋出修補更新，呼籲系統管理員與用戶立即更新系統。 據《Hacker News》報導，Debian、Ubuntu 官方及 APT 開發團隊於 11 月 4 日發布安全通報指出，這項漏洞主要源於 APT 處理中斷下載後「自動重試」的邏輯缺陷。 正常情況下，APT 下載軟體套件時會嚴格驗證數碼簽章以確保檔案未被竄改。然而，當攻擊者具備竄改客戶端與鏡像站（Mirror）之間 HTTP 網絡傳輸的能力時（例如惡意 Proxy、遭入侵的鏡像站或處於同一區域網絡的攻擊者），便可利用 HTTP 重定向（Redirect）與伺服器暫時性錯誤，誘發 APT 啟動重新下載機制。 https://thehackernews.com/2026/11/debian-and-ubuntu-apt-flaw-lets-mitm.html 此時，攻擊者便能在數碼簽章驗證通過後，暗中將合法套件置換成惡意軟體。由於 APT 誤判該檔案已通過檢驗，系統便會直接安裝執行，導致惡意程式碼直接取得作業系統的 Root 最高管理員權限。 已知影響範圍涵蓋主流版本，該漏洞主要衝擊預設啟用自動重試機制（Acquire::Retries）的作業系統版本，當中 Debian 12、Ubuntu 22.04 LTS、24.04 LTS、26.04 LTS、26.10 以及基於兩者開發的衍生 Linux 發行版皆屬高危版本；舊版系統亦不可掉以輕心，若手動開啟了 Acquire::Retries 參數，同樣存在受害風險。 目前，Debian 與 Ubuntu 官方已陸續在安全軟體庫（Security Archive）釋出修復版 APT 套件： ◾Ubuntu 26.10：更新至 3.3.3ubuntu0.1 ◾Ubuntu 26.04 LTS：更新至 3.2.1ubuntu0.1 ◾Ubuntu 24.04 LTS：更新至 2.8.4ubuntu0.1 ◾Ubuntu 22.04 LTS：更新至 2.4.15ubuntu0.1 ◾Debian 11（ELS）：釋出 2.2.5 修復版本 ◾Debian 12（Bookworm）：安全更新版 資安專家提醒，使用 Debian 與 Ubuntu 伺服器的企業與個人用戶，應立即執行套件更新指令完成修補，以降低因傳輸節點遭受攔截竄改而面臨整機失守的資安風險。

🚨 Vulnerabilidad crítica en APT: un ataque MITM podría ejecutar código como root en #Linux. Debian ha publicado una alerta de seguridad por la vulnerabilidad CVE-2026-109518, que afecta al gestor de paquetes APT. El fallo permite que un atacante situado entre el equipo y el servidor de descarga manipule paquetes durante la reanudación de una descarga HTTP, sustituyendo un paquete incluso después de su verificación. ¿El resultado? Ejecución de código arbitrario con privilegios de root. 🔧 Solución: Debian ya publicó la corrección en APT 3.0.4 para Debian 13 (Trixie). https://lists.debian.org/debian-security-announce/2026/msg00526.html #Linux #Debian #Ciberseguridad #SysAdmin

Falha crítica no APT, CVE-2026-109518: quem controla o tráfego HTTP de download troca um pacote verificado e roda código como root. Depende de retry, padrão desde Debian 12 e Ubuntu 22.04. Atualize o APT em hosts, imagens de contêiner e runners de CI. https://thehackernews.com/2026/11/debian-and-ubuntu-apt-flaw-lets-mitm.html

Une faille dans APT permet de modifier un paquet après sa vérification de sécurité. CVE-2026-109518 : un attaquant sur le réseau peut exploiter la reprise des téléchargements HTTP pour exécuter du code en root. Corrigé dans APT 3.0.4 sur Debian 13 https://www.phoronix.com/news/Debian-APT-MITM-RCE https://t.co/YdvOSfyUky

Fixes are available for CVE-2026-109518 on Ubuntu. Finally!

Debian's apt can be tricked into installing a tampered package as root. Patch it now. CVE-2026-109518 is in how apt resumes interrupted HTTP downloads. If a redirect points two downloads at the same address, apt can merge them into one file, and a man-in-the-middle can change that file after it has already passed the signature check. Fixed versions: • Debian 13 (trixie): apt 3.0.4 • Debian 12 (bookworm): apt 2.6.2 • unstable (sid): apt 3.3.6 Check yours with apt --version. If it's older, run sudo apt update, then sudo apt install apt.

👉 CVE-2026-109518 APT açığı için Ubuntu'da da aynı işlemi yapın.

🚨 Debian APT'de Root RCE açığı: CVE-2026-109518! Debian'ın paket yöneticisi APT'deki bir dosya işleme hatası, MITM saldırganının HTTP redirect ve yarım kalan indirmeleri devam ettirme mekanizmasından yararlanarak doğrulamadan geçmiş paketi değiştirmesine ve root yetkisiyle kod çalıştırmasına imkan tanıyor. Bu açık Debian 13: APT 3.0.4 ile düzeltildi. Güncellemenizi geciktirmeyin! Security tracker: https://security-tracker.debian.org/tracker/apt İlgili duyuru: https://lists.debian.org/debian-security-announce/2026/msg00526.html

A critical APT flaw (CVE-2026-109518) in Debian and Ubuntu allows Man-in-the-Middle attackers to swap already-verified package downloads and execute arbitrary code as root. The vulnerability exploits HTTP redirects and interrupted download retries, bypassing package integrity verification. Default configurations expose Debian 12+ and Ubuntu 22.04+. Older releases may also be affected if retries are enabled manually. Patches are rolling out. Update APT.

Debian and Ubuntu security advisories: Debian: https://lists.debian.org/debian-security-announce/2026/msg00526.html Ubuntu: https://ubuntu.com/security/CVE-2026-109518 Technical analysis: https://thehackernews.com/2026/11/debian-and-ubuntu-apt-flaw-lets-mitm.html Check your distribution's patched APT version before upgrading.

🛑 Linux - CVE-2026-109518 Une faille dans APT permet de remplacer un paquet déjà vérifié et de l'exécuter en root. Plusieurs distributions Linux, dont Debian, Ubuntu et leurs dérivées sont concernées. Tous les détails ici : - https://www.it-connect.fr/faille-apt-cve-2026-109518-debian-ubuntu-root/ #linux #infosec https://t.co/MCPvUdLlJ5

apt の脆弱性 CVE-2026-109518 が Ubuntu の公式アドバイザリーに上がってた。 apt クライアントとアーカイブサーバの間のHTTP通信を改ざんできる経路上の攻撃者が、パッケージのインストールをきっかけに未検証の攻撃者製パッケージをインストールさせ、root権限でコードを実行できるらしい。 条件としては Acquire::Retriesの設定値が「0」以外に設定されている必要があるけど、Ubuntu 22.04 LTS以降は既定値が「3」なので条件クリアしている可能性が高い https://ubuntu.com/security/notices/USN-8996-1