An APT flaw lets an on-path attacker swap a verified package and run code as root on Debian and Ubuntu

On November 4, 2026, Debian and Ubuntu published fixes for CVE-2026-109518, a critical APT flaw that lets a man-in-the-middle replace an already-verified package with their own, then execute code as root. Update apt today and move your sources to HTTPS until every host is patched.