Debian's APT Affected By Man-In-The-Middle Attack For Arbitrary Code Execution As Root

A new vulnerability was disclosed today affecting Debian's APT package manager where a man-in-the-middle attacker could carry out arbitrary code execution as root. An APT security advisory was issued today due to this vulnerability where improper file handling could lead a man-in-the-middle attacker to execute arbitrary code as root. This vulnerability is tracked as CVE-2026-109518 though as of writing the report in full hasn't been made public. The Debian DSA 6607-1 summarizes it as: "Max Justicz discovered a vulnerability in the APT package manager. APT can merge two different package downloads after an HTTP redirect gives them the same URI. Improper file handling when resuming an HTTP download allows a man-in-the-middle attacker to replace a package after verification, resulting in the execution of arbitrary code as root. For the stable distribution (trixie), this problem has been fixed in version 3.0.4. Additionally this update addresses several out-of-bounds access issues. We recommend that you upgrade your apt packages." Time to update APT.