APT Flaw Let Attackers Swap Verified Linux Updates for Fakes

Debian and Ubuntu Fix APT Flaw That Turned Updates Into Takeovers

Your Linux servers trust one program to check that every update is genuine. This week, we learned it could be talked into installing a fake. If your updates pass through a mirror or proxy you don’t fully control, keep reading.

At a Glance

• Who should care: Anyone running Debian or Ubuntu servers, or building software on them.
• What could go wrong: Someone who can tamper with the download path could take full control of a server during an ordinary update.
• Do this: Install the fix with retries off, and move package sources to HTTPS where your mirror supports it.

What Happened?

On Wednesday, 4 November 2026, the developers of APT, the package manager on Debian and Ubuntu, published advisory APT-2026-11-01. They called CVE-2026-109518 a “critical file verification bypass.” Debian (DSA-6607-1) and Ubuntu (USN-8996-1) shipped fixes the same day.

The bug lives in APT’s hard link reuse and retry logic. An attacker on the download path, like a malicious mirror or proxy, mixes HTTP redirects with fake server errors. APT checks one file and installs another.

How Bad Is It, and Who’s Exposed?

Severity and Exploitation

Ubuntu and the CVE record rate it 7.7 High on CVSS v4.0. There is no EPSS score yet as of 4 November 2026. No advisory reports attacks; CISA’s note of 4 November records exploitation as none.

Which Releases Are Exposed

Retries are on by default in Debian 12 and Ubuntu 22.04. Those releases, and everything newer, are exposed out of the box. Older releases are at risk only if someone enabled retries.

Fixed APT Versions

• Debian 12: apt 2.6.2
• Debian 13: apt 3.0.4
• Ubuntu 22.04 LTS: apt 2.4.15ubuntu0.1
• Ubuntu 24.04 LTS: apt 2.8.4ubuntu0.1
• Ubuntu 26.04 LTS: apt 3.2.1ubuntu0.1
• Ubuntu 26.10: apt 3.3.3ubuntu0.1

What’s the Impact?

Package installs run as root, the admin account that controls everything. So a swapped package means the attacker’s code runs with full control of the server. One poisoned mirror could reach every machine that trusts it, including build servers that ship your software.

Is There a Stopgap?

Reports split on this. Researchers says no advisory offers a workaround for systems that can’t update yet. Ubuntu’s blog offers two: switch sources to HTTPS, or set retries to zero. Ubuntu says either one blocks the attack. We follow Ubuntu.

Here’s the catch. The fix travels over the same path the attack uses. Build pipelines that share one proxy or mirror are where that path is most common (our reading).

How to Avoid This

• Patch with retries off, as Ubuntu advises: sudo apt update && sudo apt upgrade -o Acquire::Retries=0
• Move package sources to HTTPS where your mirror supports it, then run sudo apt update and check for errors.
• List every proxy, cache, and mirror your servers and pipelines pull from.
• Rebuild container images from a fixed base image. Old images keep the old APT.

One Check Is One Bug Away From Nothing

The signature check was supposed to make the download path irrelevant. Sign the package, and who cares who carries it?

This bug shows why that thinking falls short. The step that checks an update can be bypassed. One check is one bug away from zero checks.

So protect the path as well as the package. HTTPS for package sources, long treated as optional in the Debian world, is now that second layer.

Frequently Asked Questions