Heads up if you run Ubuntu or Debian servers. A new APT flaw was published on Nov 4, and how you install the fix matters.

CVE-2026-109518 is in APT's HTTP backend, so it affects apt, apt-get and aptitude. Ubuntu rates it High (CVSS 4.0 score 7.7). An attacker who can tamper with your HTTP traffic, or a malicious mirror, can get APT to install a package that failed signature verification. Package scripts run as root, so that means root on the box. It needs a retried download to work. Neither Ubuntu nor Debian says it is being exploited.

Ubuntu's recommended update turns retries off while you patch:

sudo apt update && sudo apt upgrade -o Acquire::Retries=0

If a full upgrade isn't possible right now:

sudo apt update && sudo apt install -o Acquire::Retries=0 --only-upgrade '?source-package(^apt$)'

To check your version:

apt list --installed '?source-package(^apt$)'

Fixed versions:

- Ubuntu 22.04: 2.4.15ubuntu0.1

- Ubuntu 24.04: 2.8.4ubuntu0.1

- Ubuntu 26.04: 3.2.1ubuntu0.1

- Debian trixie: 3.0.4 (the advisory only names trixie, so check the Debian tracker for other releases)

Other things Ubuntu notes: HTTPS protects against the on-path case, but some community and country mirrors don't support it. Unattended-upgrades applies the patch within 24 hours if you have it enabled.

Question for people running apt-cacher-ng or a local mirror: is the traffic between your clients and the cache plain HTTP, and are you changing anything because of this? Neither advisory covers that setup.

Sources:

- Ubuntu: https://ubuntu.com/blog/apt-vulnerability-fixes-available

- Debian DSA 6607-1: https://lists.debian.org/debian-security-announce/2026/msg00526.html

- Debian tracker: https://security-tracker.debian.org/tracker/apt

(Drafted with AI help. The facts are from the pages linked above.)