Debian, Ubuntu & derivative Linux distros vulnerable to MiTM attacks due to APT bug

Debian, Ubuntu, and derivative Linux distributions are reportedly¹ vulnerable to potential man-in-the-middle attacks due to a bug (CVE-2026-109518²) in package manager APT³ that was just discovered by Charge Robotics⁴ cofounder Max Justicz⁵:

[critical file verification bypass] It was discovered that a remote attacker could bypass verification of downloaded packages using redirects and standard transient HTTP server errors that cause APT to retry downloads, leading APT to override existing hardlinks with a chosen payload. As debs are installed with root privileges, this provides the potential for remote code execution.

Mitigation

Upgrade apt packages to patched versions:
 - bookworm: 2.6.2
 - trixie: 3.0.4
 - sid: 3.3.6
 - Ubuntu 26.10: 3.3.3ubuntu0.1
 - Ubuntu 26.04 LTS: 3.2.1ubuntu0.1
 - Ubuntu 24.04 LTS: 2.8.4ubuntu0.1
 - Ubuntu 22.04 LTS: 2.4.15ubuntu0.1

Older versions including Debian 11 and Ubuntu 20.04 are not affected in the default config, unless the Acquire::Retries setting was turned on by the user.

The flaw was apparently discovered using GPT 5.6 Sol (Daybreak Blue) in only two hours⁶ and it was fixed in the latest version of APT⁷.

Notes: Debian testing (forky) is still unpatched currently (v3.3.5); it is unclear if package sources reached over HTTPS are also exposed; no attacks exploiting the flaw were mentioned by any of the sources; no alternative mitigation for systems that cannot immediately update was provided.

This is an ongoing story and the report will be updated when new information is available.