4 Nov 2026
Debian, Ubuntu, and derivative Linux distributions are reportedly vulnerable to potential man-in-the-middle attacks due to a bug (CVE-2026-109518) in package manager APT that was just discovered by Charge Robotics cofounder Max Justicz:
[critical file verification bypass] It was discovered that a remote attacker could bypass verification of downloaded packages using redirects and standard transient HTTP server errors that cause APT to retry downloads, leading APT to override existing hardlinks with a chosen payload. As debs are installed with root privileges, this provides the potential for remote code execution.
Mitigation
Upgrade apt packages to patched versions:
- bookworm: 2.6.2
- trixie: 3.0.4
- sid: 3.3.6
- Ubuntu 26.10: 3.3.3ubuntu0.1
- Ubuntu 26.04 LTS: 3.2.1ubuntu0.1
- Ubuntu 24.04 LTS: 2.8.4ubuntu0.1
- Ubuntu 22.04 LTS: 2.4.15ubuntu0.1
Older versions including Debian 11 and Ubuntu 20.04 are not affected in the default config, unless the Acquire::Retries setting was turned on by the user.
The flaw was apparently discovered using GPT 5.6 Sol (Daybreak Blue) in only two hours and it was fixed in the latest version of APT.
Notes: Debian testing (forky) is still unpatched currently (v3.3.5); it is unclear if package sources reached over HTTPS are also exposed; no attacks exploiting the flaw were mentioned by any of the sources; no alternative mitigation for systems that cannot immediately update was provided.
This is an ongoing story and the report will be updated when new information is available.
