APT’s package check has a hole. Patch the package manager first.

An attacker who can interfere with an APT package download may get an unverified package installed and run code as root. That is the threat from a newly disclosed flaw in the package manager’s verification process. It takes specific conditions—not merely a Linux machine connected to the internet—but it puts a trusted part of the update process at risk.

The bug is CVE-2026-109518. Debian has issued fixes for Debian 12 and 13. Ubuntu also identifies affected releases, but its security page still listed them as vulnerable when I checked on 4 November. This is a reason to act promptly, not a reason to grab a random .deb from somebody’s social-media post.

What actually has to happen?

The attacker needs to manipulate HTTP traffic between APT and an archive server. A malicious mirror or proxy could be in that position. The client also has to follow redirects and retry a package download; the flaw involves reused hard links during that process. Ubuntu says Acquire::Retries must be nonzero, and that a value of three became the default with Debian 12 and Ubuntu 22.04.

That is serious, but it is not a claim that any stranger on the internet can silently take over an idle laptop. The dangerous moment is an APT-driven package installation under those conditions. A successfully substituted package can run its installation code with root privileges. I have not found a confirmed report of this particular bug being exploited in the wild.

Check which system you are running

In a terminal, run:

cat /etc/os-release

dpkg-query -W -f='${Version}\n' apt

The first command identifies your distribution and release. The second prints the installed APT version. If you manage a fleet, record those two facts for each machine; “we use Linux” is not specific enough for this patch.

On Debian 12 or 13, install the security update

Debian’s security tracker lists apt 2.6.2 as the fixed version for Debian 12 (bookworm), and apt 3.0.4 for Debian 13 (trixie). Use your configured Debian repositories, including the appropriate security repository. Then run:

sudo apt update

sudo apt install --only-upgrade apt

dpkg-query -W -f='${Version}\n' apt

Check that the final version is at least the fixed version for your release. apt-cache policy apt will show the installed version, the available candidate and the repository it comes from. If the fixed version is not available, do not declare the machine patched: check that security updates are enabled, refresh your package lists and investigate a pinned package, stale mirror or unsupported release. A package-manager update may pull in related libraries; let APT resolve its normal dependencies.

If this is a production server, use your normal change window and recovery plan, but do not let that become an excuse to leave the updater itself exposed indefinitely. Once APT is patched, continue with the rest of your security updates.

On Ubuntu or a derivative, follow its own advisory

Do not install Debian’s apt 3.0.4 package onto Ubuntu just because that version appears in the headline. Ubuntu publishes its own package builds and fixes. As of 4 November, Ubuntu’s CVE page listed its releases as vulnerable. Check that page for a fixed status and version for your Ubuntu release, then apply the update from Ubuntu’s normal security repositories and verify the installed version. Derivatives should follow their own maintainer’s guidance too.

Switching mirrors, turning off retries or assuming HTTPS makes the problem disappear is not a substitute for a confirmed patched package. The reliable check is your distribution’s advisory plus the version actually installed on the machine.

The lesson is simple: the updater is part of the security boundary, not just the thing that delivers security fixes. Patch it through a trusted channel, verify the result, and then get back to the rest of the backlog.