Debian patches an apt bug that let MITM attacks run code as root
A flaw in how apt resumes interrupted downloads let a network attacker swap in a malicious package after the signature check had already passed.
Debian has patched a vulnerability in apt, the package manager underlying Debian and its many derivatives, including Ubuntu and most container base images. The bug, CVE-2026-109518, was published as DSA-6607-1 on 4 November and credited to researcher Max Justicz.
The flaw sits in how apt resumes an interrupted HTTP download. A redirect can make two different package downloads look like the same URI, and apt’s file handling lets a man-in-the-middle attacker use that confusion to substitute a different package after its signature has already been checked, leading to arbitrary code execution as root. The fix lands in apt 3.0.4 for the stable release, trixie, alongside a handful of unrelated out-of-bounds fixes.
Why it matters: this bypasses the exact protection apt’s signing system is meant to provide. Anywhere packages get fetched over a network you don’t fully trust, a CI runner on shared infrastructure, a build inside a cloud VPC, a laptop on public Wi-Fi, a routine apt upgrade could hand an attacker root. Patch it on the next update rather than waiting for your usual cycle.