What Happened
Debian and Ubuntu released fixes for CVE-2026-109518, a flaw in APT, The Hacker News reports. Max Justicz reported it. An attacker who modifies HTTP traffic between APT and a package server, through a malicious mirror or proxy, uses redirects and temporary server errors to force a retry. APT then installs a swapped package, and the attacker’s code runs as root.
Ubuntu rates the flaw 7.7 under CVSS 4.0 and calls it high priority. APT’s developers call it critical. APT retries failed downloads by default from Debian 12 and Ubuntu 22.04 onward. Older releases are not exposed by default, but scripts sometimes enable the Acquire::Retries setting. The advisories report no exploitation.
Why This Matters for Canadian Organizations
Debian and Ubuntu run servers, containers, and build pipelines in Canadian banks, universities, hospitals, and government clouds. Many teams route package traffic through internal proxies and mirrors. Each proxy is a place where an attacker with network access sits in the path.
Root access on a build server or base image reaches far past one machine. Poisoned images spread to every system built from them. The advisories describe the attack over HTTP and do not say whether HTTPS sources are exposed, so treat the question as open. Organizations handling personal information still carry PIPEDA duties if a compromised host exposes it.
What to Do
Update APT now. Ubuntu published 26.10 3.3.3ubuntu0.1, 26.04 LTS 3.2.1ubuntu0.1, 24.04 LTS 2.8.4ubuntu0.1, and 22.04 LTS 2.4.15ubuntu0.1. Debian 11 gets 2.2.5. Ubuntu 14.04 users need Ubuntu Pro for the fix. Rebuild container base images and golden images with the fixed version. Audit proxy and mirror settings, and drop any plain HTTP source. Search scripts and configuration for Acquire::Retries on older releases. Check package installation logs for unexpected packages from recent days. Read more TechTalk coverage and our latest news.
