Malware News Careful with “apt upgrade”: hackers can swap verified packages and deliver malware

[Brownie2019]

Content source

https://cybernews.com/security/apt-upgrade-attackers-swap-verified-packages-deliver-malware/

To pull off the attack, attackers first need to gain control of the network connection.
Key takeaways

1. 01Debian and Ubuntu patched a serious APT package manager flaw that could let attackers install malware.
2. 02Attackers need control of the network path between a Linux system and its package server.
3. 03The attack can swap a verified package with a malicious one and run it with root privileges.
4. 04Ubuntu advises disabling retries during the update and patching every machine, container, and build runner.

An attacker sitting between a Linux system and its package mirror can exploit a severe APT flaw to swap legitimate packages, even after the validation that they are safe. Debian and Ubuntu have released security updates.

Debian and Ubuntu have patched a severe flaw in APT, a package manager used by the major Linux distributions.

APT uses unencrypted HTTP for download handling. Attackers-in-the-middle can replace the package after verification, resulting in arbitrary code execution as root.

Security researcher Max Justicz discovered, disclosed, and helped patch this vulnerability, tracked as CVE-2026-109518. The flaw is rated 7.7 out of 10 on the severity scale, but successful exploitation could potentially lead to a complete compromise with little effort.

Read full Story:

Severe APT flaw: hackers can swap legitimate packages for malware on the fly

7.7-rated APT flaw lets on-path attackers swap Linux packages after checks; Debian and Ubuntu have fixes.

cybernews.com

 

[Bot]

Read full Story: (link omitted)

Hi Brownie2019, this is a genuine high-severity flaw, although the headline needs its conditions attached. Exploitation requires HTTP package traffic, a party able to manipulate that traffic—such as an on-path attacker, proxy or malicious mirror—and retries enabled. The default configuration is affected from Debian 12 and Ubuntu 22.04 LTS onward; older versions can still be affected if Acquire::Retries was enabled manually.

Importantly, this is not a cryptographic signature break. APT verifies the package, but incorrect handling of hard links, redirects and resumed downloads can allow the already-verified cached file to be altered before installation—a classic check-versus-use failure. Package maintainer scripts then execute as root. Debian describes the mechanism in DSA-6607-1, while Ubuntu’s notice confirms the root-code-execution impact.

Also, “APT uses unencrypted HTTP” is too broad: APT supports HTTPS. Using HTTPS protects against the ordinary on-path attack route, but installing the corrected APT package remains the proper fix.

For the first update on a potentially affected system, disable retries explicitly:

sudo apt-get -o Acquire::Retries=0 update
sudo apt-get -o Acquire::Retries=0 install --only-upgrade apt

Then complete the normal system upgrade. Current fixed versions include:

• Debian 12/Bookworm: 2.6.2
• Debian 13/Trixie: 3.0.4
• Ubuntu 22.04 LTS: 2.4.15ubuntu0.1
• Ubuntu 24.04 LTS: 2.8.4ubuntu0.1

The Debian security tracker and Ubuntu advisory should be used for exact release-specific versions. Containers, base images and build runners need updating or rebuilding separately; patching only the host does not magically fix APT inside them. The irony of needing APT to patch APT is manageable here—disable retries or use trusted HTTPS sources for that first installation.

Sources

• CVE-2026-109518
• USN-8996-1: APT vulnerability | Ubuntu security notices | Ubuntu