APT Will Install an Attacker's Package as Root if Someone Can Tamper With the Download. CVE-2026-109518 Touches Every Ubuntu Release From 14.04 to 26.10, and the Fix Is Different for Each.
If you run Debian or Ubuntu and install packages over a network you do not fully control, update APT now. The Hacker News reports that CVE-2026-109518 lets an attacker who can modify your package downloads swap a package that APT has already checked for one of their own, and that package then runs as root when it is installed. APT's developers call the flaw critical. Ubuntu rates it high priority, CVSS 4.0 score 7.7. None of the three advisories described attacks in the wild.
What it is
APT is the package manager on Debian, Ubuntu and the systems built on them. The report says an attacker positioned between APT and the server it downloads from, for example through a malicious mirror or proxy, can use HTTP redirects and temporary server errors to make APT retry a download. During that retry the attacker replaces the verified package with their own. The attack runs at install time, and the attacker's code runs as root.
Who is exposed
By default, APT retries failed downloads on Debian 12 and Ubuntu 22.04 and later, which is where the attack has room to work. Debian 11 and Ubuntu 20.04 are not exposed by default, but a script may have turned on the Acquire::Retries setting there. Debian testing was on vulnerable version 3.3.5 on November 4, and Ubuntu marked all eight tracked releases, 14.04 LTS through 26.10, as vulnerable. The report says distributions built on Debian and Ubuntu are probably affected too, though it names none.
The attacker needs to alter the traffic, so the realistic cases are a mirror you do not control, a proxy or captive network, and any hop that serves your downloads over plain HTTP. That is our reading of the position the report describes.
Fixed versions, as reported
- Debian 11: 2.2.5. The report does not give fixed versions for the other Debian stable releases.
- Ubuntu 26.10: 3.3.3ubuntu0.1.
- Ubuntu 26.04 LTS: 3.2.1ubuntu0.1.
- Ubuntu 24.04 LTS: 2.8.4ubuntu0.1.
- Ubuntu 22.04 LTS: 2.4.15ubuntu0.1.
- Ubuntu 14.04: a fix is available through Ubuntu Pro.
- Ubuntu 20.04 and the other releases: not stated.
To apply a fix, update your package lists and upgrade the apt package from your distribution's security channel, then confirm the installed version against the table above for your release.
What you can do before you patch
The report gives no workaround. Two steps follow from the attack's position, and they are our reasoning, not a vendor recommendation. Prefer a mirror and a network path you trust, so there is no one in the middle to swap a download. And treat any build that installs packages over an untrusted network, including Docker image builds, as the place this would bite first. We have not tested whether HTTPS sources are protected, and the report does not say.
What is not known
Whether anyone is exploiting it. Fixed versions for Debian stable releases other than 11. Ubuntu 20.04's status. A workaround for machines that cannot update. Whether HTTPS package sources are exposed. Any indicators of compromise. No network indicators were published, so there is nothing to add to the feed from this story.
Limits
One secondary report from The Hacker News, citing the Debian, Ubuntu and APT advisories. We did not read those advisories or the researcher Max Justicz's write-up, did not test the flaw, and did not check our own machines. Version numbers and dates are as reported. Our own container builds use Debian base images, so they run APT; we have not audited when each build last pulled packages or over what path.
Five percent of this is wrong somewhere. It always is. The advisories will correct a fixed version or tell you which Debian stable release carries which patch.
Was this useful? Rate this post. The widget is at the bottom of the page, and we read every response.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.