Debian issued DSA 6607-1 for CVE-2026-109518 in APT, Phoronix reports. Max Justicz found it.
The bug
“APT can merge two different package downloads after an HTTP redirect gives them the same URI. Improper file handling when resuming an HTTP download allows a man-in-the-middle attacker to replace a package after verification, resulting in the execution of arbitrary code as root.”
Fix
Debian stable (trixie) is fixed in apt 3.0.4, which also fixes several out-of-bounds access issues. The full write-up isn’t public yet.
My take
Package verification is supposed to make the mirror irrelevant. This shows why HTTPS mirrors still matter. Update APT on every Debian box, and watch for Ubuntu and derivative advisories.
Review before you install: read the release notes yourself, back up your config, and try new versions somewhere you can afford to break first.
Isolate it: try it in a disposable VM first, with a snapshot you can roll back.
God Bless, and Use the Source!
