Debian and Ubuntu fixed a flaw in APT, the package manager behind apt and apt-get, on 4 November 2026. Ubuntu's notice USN-8996-1 says researcher Max Justicz found that APT "incorrectly handled hard links when encountering redirects and retrying package downloads", so a remote on-path attacker could possibly install an unverified package and run code as root. It is tracked as CVE-2026-109518.
How it works, per SecurityOnline: an attacker who sits between the server and the mirror, or runs a rogue mirror, intercepts HTTP downloads of .deb files and uses redirects and server errors to force retries; during a retry APT can be made to install a file that failed its checks, and package install scripts run as root. Ubuntu rates it high (CVSS v4 7.7); Debian's maintainer rated it critical, SecurityOnline reports.
Who is exposed: the attack needs Acquire::Retries to be non-zero, which is the default since APT 2.3.2 — so default installs of Debian 12 and 13 and Ubuntu 22.04 LTS and later. Debian 11 and Ubuntu 18.04/20.04 are only exposed if retries were turned on. HTTPS repositories and snaps are not exposed to this network attack, and SecurityOnline says derivatives such as Kali Linux, Linux Mint and Proxmox VE inherit the bug.
Fixed APT versions: Ubuntu 26.10 3.3.3ubuntu0.1, 26.04 LTS 3.2.1ubuntu0.1, 24.04 LTS 2.8.4ubuntu0.1, 22.04 LTS 2.4.15ubuntu0.1, older LTS releases through Ubuntu Pro and Legacy Support; Debian 13 3.0.4, Debian 12 2.6.2, Debian 11 2.2.5. No exploitation in the wild and no public exploit tool are reported.
