As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-109518: RCE in apt(1) (DSA 6607-1)
A vulnerability in the APT package manager allows a man-in-the-middle attacker to replace packages during HTTP downloads when APT merges two different downloads after an HTTP redirect assigns them the same URI. The issue stems from improper file handling when resuming downloads and was discovered by Max Justicz.
Why it matters: Linux system administrators and operators using Debian and APT-based distributions need to patch immediately, as attackers on the network path can inject malicious packages into systems during updates.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-109518: RCE in apt(1) (DSA 6607-1)
A vulnerability in Debian's APT package manager (CVE-2026-109518) allows a man-in-the-middle attacker to replace a package during HTTP download resumption after an HTTP redirect merges two different package downloads into one URI. The flaw stems from improper file handling in APT's download process.
Why it matters: Debian users relying on APT for package management face remote code execution risk from network-positioned attackers; patch via Debian Security Advisory 6607-1 immediately.
- Source published
- First seen by Cybersecurity Tracker