News · written 10 November 2026. A summary for readers, not technical advice — check the sources at the end for the details.

APT is the package manager behind Debian, Ubuntu and the many systems built on them: it is what downloads and installs your software and its updates. On 4 November 2026 both projects published a security fix for it — Debian as DSA-6607-1 and Ubuntu as USN-8996-1, for CVE-2026-109518.

What the problem was

In Debian's words, "Improper file handling when resuming an HTTP download allows a man-in-the-middle attacker to replace a package after verification, resulting in the execution of arbitrary code as root." Ubuntu puts it this way: "A remote on-path attacker could possibly use this issue to trick APT into installing an unverified package."

• Who could attack: someone in the middle of your download traffic — Debian's security tracker names "a malicious mirror or proxy" as examples.
• When: only when APT follows a redirect and retries a download. Retrying is switched on by default from Debian 12 (bookworm) and Ubuntu 22.04 LTS, so older releases are unaffected in a default setup, according to the tracker.
• Found by: Max Justicz.
• How serious: Ubuntu rates it priority High (CVSS 7.7). Debian's pages do not give a rating.

Fixed versions

• Debian 13 (trixie): apt 3.0.4.
• Debian 12 (bookworm): apt 2.6.2, according to Debian's security tracker.
• Ubuntu 26.10: 3.3.3ubuntu0.1 · 26.04 LTS: 3.2.1ubuntu0.1 · 24.04 LTS: 2.8.4ubuntu0.1 · 22.04 LTS: 2.4.15ubuntu0.1. Older Ubuntu LTS releases get fixes through Ubuntu Pro.

What to do

Debian's advice is short: "We recommend that you upgrade your apt packages." Ubuntu says "a standard system update will make all the necessary changes." If your computer or server installs updates automatically, check that it has picked this one up.

What it means for people who ship software

If you publish .deb packages, your users install them with APT. This fix closes one way a package could be swapped on its way to them — a good moment to remind them to keep their system updated.

Sources

• Debian — DSA-6607-1 apt, 4 November 2026.
• Debian security tracker — CVE-2026-109518 (conditions and fixed versions per release).
• Ubuntu — USN-8996-1: APT vulnerability, 4 November 2026.
• Ubuntu — CVE-2026-109518 (priority and score).

More news and guides at https://jmtechpower.com/articles.