#debian

November 5, 2026

APT package manager flaw lets an on-path attacker install an unsigned .deb as root (CVE-2026-109518). APT can merge two different package downloads after a retry, letting a package that failed signature verification be installed; Debian 12+ and Ubuntu 22.04+ are affected by default because Acquire::Retries is non-zero. CVSS 4.0 of 7.7, HTTPS mirrors block the attack, reported by Max Justicz (Ubuntu, The Hacker News). · Vulnerabilities & Public Exploits