Package managers are supposed to be the part of Linux you don't have to think about. CVE-2026-109518 changes that for anyone running APT, the package manager behind Debian, Ubuntu, and their derivatives. An attacker who can manipulate HTTP traffic between an APT client and an archive server can install a package without verification, and that package runs with root privileges.
How the bug actually works
The trouble sits in how APT handles HTTP redirects and resumed downloads. Debian's advisory puts it bluntly: APT can merge two different package downloads after a redirect gives them the same URI. Improper file handling during a resumed download then lets a man-in-the-middle attacker replace a package after it has passed verification. The result is arbitrary code running as root.
APT's developers describe the mechanics more precisely. Redirects and transient HTTP server errors can trigger download retries, and during those retries APT can overwrite existing hard links with an attacker's payload. Debian packages install with root privileges, so a successful substitution is a straight path to root.
Ubuntu frames the required position as an on-path attacker who can tamper with traffic between the client and the archive. A malicious mirror or proxy could fill that role, though the attack depends on specific download conditions. That's a narrower threat than "any server on the internet," but it's a realistic one for anyone pulling packages through third-party infrastructure.
Discovery and the AI angle
Debian disclosed the flaw on November 4, crediting security researcher Max Justicz. Ubuntu later rated it High with a CVSS score of 7.7. Justicz was blunt about how he found it: "I used an AI for two hours and found a zero-day that would let a nation-state hack any server running stock Ubuntu." That's a provocative claim, and it's worth reading alongside the retry-default details below, because the exposure on stock systems hinges on a single setting.
Retry settings decide who's exposed
The vulnerability only bites when APT's Acquire::Retries setting is non-zero. APT's developers say retries have been on by default since version 2.3.2, though scripts may have enabled them on older installs. Ubuntu notes that the default retry count of three applies from Debian 12 (Bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish) onward. Older releases aren't exposed by default, but they're vulnerable if someone turned retries on.
My read: the risk isn't concentrated in exotic configurations. It's sitting in the defaults of recent releases, which means fleets that never touched APT settings are the ones most likely to be exposed.
Patches and the actual fix
Debian 13 (Trixie) is patched in APT 3.0.4, and Debian 12 (Bookworm) received the fix in 2.6.2. Ubuntu has shipped patched packages for supported releases, including 22.04 LTS, 24.04 LTS, and 26.04 LTS. Ubuntu 26.10 was also affected, and its fix was published alongside the November 4 advisory.
The underlying repair came from an October 12 commit by APT developer Julian Andres Klode. The download code now opens destination files exclusively and unlinks existing files before copying over any partial content. Writes can no longer pass through hard links to unintended targets, which closes the path the attacker relies on.
Ubuntu recommends three things during remediation: update APT, temporarily disable retries, and use HTTPS for package downloads, which blocks the traffic manipulation this attack needs. That last point is the one most teams already have covered, but "mostly" isn't the same as "everywhere," especially for internal mirrors.
For enterprise security teams, the work is practical: find vulnerable installations, audit Acquire::Retries across the fleet, and make sure patched packages reach production systems and the base images used to provision new machines. Golden images are the detail people forget, and they're where a stale APT version keeps propagating long after the fix ships.
