Debian patches APT bug allowing network attackers to run root code

First reported by Phoronix at · Updated · 4 sources

The vulnerability, tracked as CVE-2026-109518, could allow a man-in-the-middle attacker to replace a trusted software package and execute code with root privileges. RuntimeWire reported that researcher Max Justicz discovered the flaw and that Debian fixed it for its trixie release in version 3.0.4 of the APT package manager.

  • APT is also used by Ubuntu, according to Cyber Security News.

Covered by 4 publishers within 4 hours of the first report.

Reporting4

Phoronix Debian's APT Affected By Man-In-The-Middle Attack For Arbitrary Code Execution As Root · Michael Larabel
RuntimeWire Debian patches APT flaw that let network attackers swap verified packages for root code · RuntimeWire Staff
Cyber Security News Debian and Ubuntu APT Flaw Lets Hackers Hijack Software Updates and Execute Code as Root · Guru Baran
The Hacker News Debian and Ubuntu APT Flaw Lets MitM Attackers Swap Verified Packages and Run Code as Root · info@thehackernews.com (The Hacker News)

Discussion

Hacker News 9 points, 2 comments