Your Linux Servers’ Update Tool Could Be Tricked Into Installing a Swapped Package: Questions on the APT Flaw, Answered

Most Linux servers in small businesses, from web hosts to file servers, run Debian, Ubuntu or a system built on them, and all of them rely on the same tool to install updates: APT. Debian, Ubuntu and APT’s developers published advisories on November 4 for a flaw in it, and the fix is worth scheduling this week.

This explainer is based on The Hacker News’ report on the advisories.

What is the flaw?

Tracked as CVE-2026-109518, it lets an attacker who can modify package downloads replace a package APT has already checked with one of their own. The attacker’s code then runs as root when the package is installed. APT’s developers call it critical; Ubuntu rates it high priority with a CVSS 4.0 score of 7.7.

Who would be in a position to attack?

According to Ubuntu, anyone who can change the HTTP traffic between APT and the package server, including a malicious mirror or proxy. APT’s developers say the attack uses HTTP redirects and ordinary temporary server errors to push APT into retrying the download.

Which systems are exposed?

The attack depends on APT’s retry feature, which is on by default from Debian 12 and Ubuntu 22.04 onward. Ubuntu says older releases such as Debian 11 and Ubuntu 20.04 are not exposed by default, but APT’s developers warn that many scripts turn on the retry setting (Acquire::Retries) anyway. Ubuntu also says distributions built on Debian and Ubuntu are affected, without naming them.

Is there a fix?

Yes, and it is still rolling out. Debian has released fixed APT versions. Ubuntu published new builds for 26.10, 26.04 LTS, 24.04 LTS and 22.04 LTS, with other releases following, including through its Ubuntu Pro subscription. APT’s developers have also published a fixed version, 2.2.5, for Debian 11, whose long-term support ended in August.

Is anyone exploiting it?

None of the three advisories describe attacks in the wild. They also offer no workaround for systems that cannot update yet.

Does using HTTPS mirrors protect me?

The advisories describe the attack over HTTP and do not say whether package sources reached over HTTPS are exposed, so do not count on it as a substitute for updating.

Who found it?

The flaw was reported by researcher Max Justicz.

What should I do first?

List your Debian and Ubuntu machines, including virtual machines, cloud servers and appliances built on them.
Update the APT package itself as soon as your release has a fixed build, ideally from a network you trust.
Check whether scripts or configuration files on older systems turn on Acquire::Retries.
Review which mirrors and proxies your servers use for updates, and remove any you do not recognize or control.
Plan upgrades for releases that no longer receive regular security support.

What this means for your company

The update tool is part of your security, not just a way to deliver it. If a vendor, contractor or hosting provider manages Linux servers for you, ask them to confirm when APT was updated and which package sources the servers trust. Keep systems off end-of-life releases, and make sure updates are pulled from known sources over networks you control.

Do you know how your Linux servers get their updates, from where, and whether they are still on a supported release? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.