Heads up if you run Ubuntu or Debian servers. A new APT flaw was published on Nov 4, and how you install the fix matters.

CVE-2026-109518 is in APT's HTTP backend, so it affects apt, apt-get and aptitude. Ubuntu rates it High (CVSS 4.0 score 7.7). An attacker who can tamper with your HTTP traffic, or a malicious mirror, can get APT to install a package that failed signature verification. Package scripts run as root, so that means root on the box. It needs a retried download to work. Neither Ubuntu nor Debian says it is being exploited.

Ubuntu's recommended update turns retries off while you patch:

sudo apt update && sudo apt upgrade -o Acquire::Retries=0

If a full upgrade isn't possible right now:

sudo apt update && sudo apt install -o Acquire::Retries=0 --only-upgrade '?source-package(^apt$)'

To check your version:

apt list --installed '?source-package(^apt$)'

Fixed versions:

- Ubuntu 22.04: 2.4.15ubuntu0.1

- Ubuntu 24.04: 2.8.4ubuntu0.1

- Ubuntu 26.04: 3.2.1ubuntu0.1

- Debian trixie: 3.0.4 (the advisory only names trixie, so check the Debian tracker for other releases)

Other things Ubuntu notes: HTTPS protects against the on-path case, but some community and country mirrors don't support it. Unattended-upgrades applies the patch within 24 hours if you have it enabled.

Question for people running apt-cacher-ng or a local mirror: is the traffic between your clients and the cache plain HTTP, and are you changing anything because of this? Neither advisory covers that setup.

Sources:

- Ubuntu: https://ubuntu.com/blog/apt-vulnerability-fixes-available

- Debian DSA 6607-1: https://lists.debian.org/debian-security-announce/2026/msg00526.html

- Debian tracker: https://security-tracker.debian.org/tracker/apt

(Drafted with AI help. The facts are from the pages linked above.)

Heads up for anyone running Ubuntu on their self-hosted boxes.

CVE-2026-98432 is a use-after-free in the kernel's IPv4 TCP code (inet_opt / ireq_opt get freed before the RCU grace period ends). Ubuntu rates it High with a CVSS of 9.8. Red Hat's bulletin says a remote, unauthenticated attacker could win the race condition and get code execution. Neither Ubuntu nor Red Hat says it is being exploited yet.

The annoying part: as of Ubuntu's last update on Oct 30, every supported LTS is listed as "vulnerable, work in progress". There is no fixed linux package yet for 22.04, 24.04 or 26.04, so a normal apt upgrade won't fix it this time. 20.04 and older are simply listed as vulnerable.

Red Hat has published a temporary nftables mitigation that drops incoming IPv4 TCP packets that carry IP options. The core of it is:

ip protocol tcp ip hdrlength > 5 counter drop

They are clear that it reduces exposure but does not fully prevent it, and that a kernel update is the only complete fix. The full rule file and the command to remove it after patching are in their bulletin. IP options are rare in normal traffic, but I would still test it on one box before rolling it out everywhere.

Quick checks while we wait:

uname -r

apt list --upgradable 2>/dev/null | grep linux-image

For those of you with services exposed to the internet: are you applying the nftables workaround now, or just watching the Ubuntu tracker and patching when the kernel lands?

Sources:

- Ubuntu CVE tracker: https://ubuntu.com/security/CVE-2026-98432

- Red Hat RHSB-2026-016 (with the mitigation): https://access.redhat.com/security/vulnerabilities/RHSB-2026-016

(Drafted with AI help. The facts are from the Ubuntu and Red Hat pages linked above.)