sudo apt update and sudo apt upgrade today. HTTPS mirrors block the attack.Last updated: November 5, 2026
APT is the tool behind every apt install on Debian, Ubuntu, Linux Mint, Raspberry Pi OS and many other systems. It is supposed to make sure that every package it installs is signed and untouched. A bug disclosed on November 4 shows that, under the right network conditions, that guarantee could be broken. Here is what happened, who is at risk and the two commands that fix it.
What Happened
On November 4, 2026, Debian, Ubuntu and the APT developers published coordinated advisories for CVE-2026-109518, reported by security researcher Max Justicz. The APT developers call it critical; Ubuntu rates it high priority with a CVSS 4.0 score of 7.7.
The bug is in APT’s HTTP download code. When a download fails, APT can retry it. An attacker who controls the HTTP traffic can combine redirects and ordinary temporary server errors to make APT retry, and during that retry swap a package that already passed verification for one they control. Packages are installed with root privileges, so the attacker’s code runs as root.
It affects everything that uses APT under the hood: apt, apt-get, aptitude and Ubuntu’s graphical updaters. Snap packages are not affected.
Who Is at Risk
- Debian 12 and newer, Ubuntu 22.04 and newer: APT retries failed downloads by default, so they are exposed until APT is updated.
- Debian 11 and Ubuntu 20.04 or older: only exposed if
Acquire::Retrieswas set to a non-zero value, for example by a script or config management. - Derivatives such as Linux Mint, Pop!_OS, Kubuntu or Raspberry Pi OS use APT too, so they get the fix through their Debian or Ubuntu base. Check that your system has the updated APT.
- The attacker needs to be on the network path: a malicious or compromised mirror, a proxy, a hostile public Wi-Fi or a compromised router. This is not a flaw anyone can trigger from the internet against an open port.
No attacks using this flaw had been reported by any of the advisories at the time of writing.
Fixed APT Versions
| Release | Fixed APT version |
|---|---|
| Debian 13 trixie (stable) | 3.0.4 |
| Debian 12 bookworm | 2.6.2 |
| Debian unstable | 3.3.6 |
| Ubuntu 26.10 | 3.3.3ubuntu0.1 |
| Ubuntu 26.04 LTS | 3.2.1ubuntu0.1 |
| Ubuntu 24.04 LTS | 2.8.4ubuntu0.1 |
| Ubuntu 22.04 LTS | 2.4.15ubuntu0.1 |
| Ubuntu 20.04 and older | Fixed through Ubuntu Pro (ESM) |
How to Check and Update
Check which APT version you have:
apt-cache policy aptThe “Installed” line should show the fixed version for your release or a newer one. If not, update:
sudo apt update
sudo apt install --only-upgrade aptOr just run a normal sudo apt upgrade, which updates APT along with everything else. It is a good idea to do the update from a network you trust, such as your home or office connection, not a public hotspot.
Extra Protection: HTTPS Mirrors
The attack needs to modify plain HTTP traffic. If your package sources use https://, the traffic cannot be altered in transit. Look at your sources:
grep -rh "^deb \|URIs:" /etc/apt/sources.list /etc/apt/sources.list.d/If you see http:// mirrors and your mirror supports HTTPS (Debian’s deb.debian.org and Ubuntu’s official archives do), you can switch the URL to https://. Test with sudo apt update afterwards.
If you manage machines that cannot be updated right away, the advisories explain that exploitation requires APT to retry a failed download. Setting Acquire::Retries "0"; in a file under /etc/apt/apt.conf.d/ disables retries, but updating APT is the real fix.
Why It Matters
Package signatures are the reason we trust apt install even over plain HTTP. A bug that lets an attacker slip a different package in after the signature check undermines that trust for millions of servers, desktops and Raspberry Pis. The fix is small and already out, so the best move is simply to update, and to consider HTTPS mirrors so the next bug like this has nothing to grab onto.
Frequently Asked Questions
What is CVE-2026-109518?
It is a flaw in APT, the package manager used by Debian, Ubuntu and their derivatives. An attacker who can tamper with the HTTP traffic between your machine and a package mirror can abuse APT’s download retry logic to swap a package that already passed verification for a malicious one. Because packages are installed as root, the attacker’s code runs as root.
Who can exploit it?
Only someone who can modify your HTTP traffic to the package server: a malicious mirror, a compromised proxy, someone on the same untrusted Wi-Fi, or a hostile network along the path. It is not a remote attack against any open port.
Am I affected?
Debian 12 and newer and Ubuntu 22.04 and newer retry failed downloads by default, so they are affected until APT is updated. Older releases like Debian 11 and Ubuntu 20.04 are only exposed if Acquire::Retries was set to a non-zero value. Snap packages are not affected.
Does HTTPS protect me?
Yes. The attack needs to manipulate plain HTTP. If your sources.list or .sources files use https:// mirrors, the traffic cannot be modified in transit.
How do I fix it?
Run sudo apt update and then sudo apt install –only-upgrade apt, or simply sudo apt upgrade. Then check the installed version with apt-cache policy apt and compare it with the fixed versions in this article.
Is it being exploited?
None of the Debian, Ubuntu or APT advisories describe attacks in the wild as of November 5, 2026.