Debian APT Flaw Lets Hackers Hijack Software Updates and Execute Code as Root

A newly disclosed bug in APT, the package manager behind Debian and Ubuntu, can let a network spy swap a trusted software package for a bad one.

The flaw is tracked as CVE-2026-109518 and can end in code running with root rights, the highest level of control on a Linux system. Debian announced the issue on November 4, 2026, and credited researcher Max Justicz with finding it.

APT checks each package against signed data before it installs anything. This flaw lets an attacker get around that check. According to Debian, APT can merge two different package downloads after an HTTP redirect gives them the same address.

When APT resumes an interrupted download, it handles the file badly, and that opens a short window to replace the package after it has been verified. The package that gets installed is then the attacker’s version, not the checked one.

The attacker must sit between the computer and the archive server. That could be someone on the same network, a rogue proxy, or a malicious mirror. The flaw also depends on hard link reuse, and it needs the client to follow redirects and retry a download.

These conditions make the attack harder than a simple remote hit, but public Wi-Fi, hijacked routers, and compromised mirrors make them realistic.

Debian APT Flaw Lets Hackers Hijack Updates

The bug only works when APT’s retry setting, Acquire::Retries, is above zero. That value is 3 by default on Debian 12 (bookworm) and Ubuntu 22.04 LTS, so older releases are not affected in their default setup. The Debian Security Tracker lists these states:

• Bookworm: version 2.6.1 is vulnerable and 2.6.2 is fixed.
• Trixie: version 3.0.3 is vulnerable and 3.0.4 is fixed.
• Testing and unstable (forky, sid): version 3.3.5 is vulnerable.

The tracker points to advisory DSA-6607-1 for trixie and DLA-4880-1 for bookworm. Ubuntu and other derivatives need their own patches, so users should watch their vendor’s notices.

The Debian advisory for trixie says the problem is fixed in APT 3.0.4 and urges users to upgrade. The same update also closes several out-of-bounds access bugs.

For the upstream project, APT 3.3.6 changes the download methods to open target files exclusively. This stops two downloads from touching the same file. The release also rejects DEB packages that lack the required Version field and fixes a sorting bug in the dependency solver.

APT has had a similar scare before. In 2019, Justicz found a remote code execution bug in apt, tracked as CVE-2019-3462. It also let a man-in-the-middle run code as root through a redirect.

His workaround then was to turn off redirects with -o Acquire::http::AllowRedirect=false. The new flaw is a different bug, but the lesson is the same. Redirects and download handling are risky parts of any update tool.

Run apt update and apt upgrade on trusted networks, and confirm the installed APT version matches the fixed one for your release. Avoid untrusted mirrors and proxies until you have patched.

Prefer HTTPS mirrors where you can, because they make interception harder. As a stopgap on unpatched systems, setting Acquire::Retries to 0 removes one required condition, though it can make updates less reliable on poor connections.

Update tools run with full trust, so one bad package can hand over a whole server. Our earlier coverage of Linux supply chain security essentials explains why checking package integrity matters.

Readers who run Debian can also see how large patch batches land in our report on Debian’s 1,313-flaw kernel update. No public reports of active use have surfaced so far. Patching now is still the safest move.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Debian APT Flaw Lets Hackers Hijack Software Updates and Execute Code as Root appeared first on Cyber Security News.