Dangerous Vulnerability Found in Debian and Ubuntu Allows Hackers to Replace Linux Updates

A serious vulnerability, CVE-2026-109518, has been discovered in APT, the popular package manager used by Debian and Ubuntu, allowing attackers to replace verified software packages with malicious ones. If successfully exploited, the flaw could enable malicious code to run with root privileges, giving hackers full control over the system. Developers of both Linux distributions have already released security fixes.

The vulnerability was discovered by security researcher Max Justicz, who reported the flaw to the developers and helped prepare a fix. Tracked as CVE-2026-109518, it received a severity score of 7.7 under CVSS 4.0, placing it in the high-severity category. The flaw affects APT, the standard package manager used by Debian, Ubuntu, and related Linux distributions to install and update software.

What makes this attack particularly dangerous is that an attacker can replace a legitimate package after its integrity has already been verified. Normally, APT downloads software packages over HTTP and verifies their authenticity using digital signatures and cryptographic hashes. If a file is modified during transmission, its checksum no longer matches the expected value, causing the installation to be blocked.

However, CVE-2026-109518 allows attackers to bypass this protection. To exploit the vulnerability, an attacker must control network traffic between the computer and the repository server. This could be achieved through a compromised network, a malicious package mirror, or a proxy server capable of modifying HTTP responses.

According to an official Ubuntu security advisory, an attacker capable of manipulating HTTP traffic between the system and the package archive server could cause a malicious .deb package to be installed and gain root privileges.

How Hackers Replace Already Verified Packages

According to StepSecurity, the vulnerability is related to APT’s mechanism for resuming interrupted downloads. By default, APT can retry a failed download up to three times, continuing the transfer from where it stopped rather than starting over. Researchers identified this behavior as the foundation of the attack.

First, the attacker intercepts two requests to download different packages and redirects them to the same URL. This causes APT to incorrectly associate both downloads with a single file, creating a hard link between them that points to the same underlying file data.

Next, the attacker deliberately interrupts the transfer by returning temporary HTTP server errors. APT attempts to resume the downloads and continues processing the files. After the first package successfully passes hash verification, the system incorrectly handles the previously created hard link. As a result, the resumed download overwrites the already verified file with malicious content.

In other words, the digital signature and checksum verification mechanisms technically work as intended, but the file that was verified is no longer the same one that ultimately gets installed. This type of vulnerability is known as Time-of-check to time-of-use (TOCTOU), where an object’s state changes between the moment it is verified and the moment it is used.

The most dangerous aspect is that installing .deb packages involves executing maintenance scripts with root privileges. If APT accepts the substituted package, the malicious code gains the highest level of access to the operating system. The attack can be triggered during ordinary software installation or updates through apt install, apt-get upgrade, and other tools that rely on the vulnerable APT mechanism.

Servers, Docker, and CI/CD Systems at Risk

CVE-2026-109518 poses a particularly serious threat to automated development environments, where software packages are often installed without direct user interaction. This includes servers, Docker containers, continuous integration and continuous deployment (CI/CD) systems, and developers’ workstations.

StepSecurity explains that compromising a CI/CD runner could expose a project’s source code, GITHUB_TOKEN tokens, cloud service credentials, signing keys, and other secrets used in automated workflows. If package substitution occurs during the creation of a Docker image, malicious code could become embedded directly into the resulting image, which may subsequently be distributed and deployed across other systems.

The consequences can be equally serious on a developer’s computer. By obtaining root privileges, an attacker could potentially compromise the entire system, including stored credentials and other sensitive information.

However, the attack does not automatically affect every Linux computer. Successful exploitation requires control over the network path used to transfer packages, an enabled download retry mechanism, and an active software installation or update process. In addition to apt and apt-get, other tools such as aptitude and graphical package managers that rely on the same APT library may also be vulnerable.

Debian and Ubuntu Have Already Released Security Updates

On November 4, 2026, Debian and Ubuntu developers released fixes for CVE-2026-109518. According to Canonical, the vulnerability affects Ubuntu 22.04 LTS and later releases under default configurations. Older versions may also be vulnerable if the Acquire::Retries parameter is set to a nonzero value.

A similar situation applies to Debian. According to StepSecurity, Debian 12 and later versions enable download retries by default, while the exposure of older systems depends on their APT configuration. In addition to CVE-2026-109518, Debian developers fixed several other vulnerabilities involving out-of-bounds memory access. Further details are available in the official Debian security advisory.

Because a regular APT update could itself become an entry point for an attack, Ubuntu recommends temporarily disabling download retries while installing the security fix. This can be done using the following command:

sudo apt update && sudo apt upgrade -o Acquire::Retries=0

The Acquire::Retries=0 parameter prevents APT from retrying failed package downloads, eliminating a condition required to exploit the vulnerability. Once the patched version of APT is installed, this package substitution vulnerability can no longer be exploited, even if the system uses a compromised repository mirror.

Canonical also recommends using HTTPS for package downloads. An encrypted TLS connection prevents third parties from tampering with HTTP traffic, although it does not replace the need to update APT itself. Meanwhile, Snap package installations and FTP downloads are not affected by this vulnerability because they use different mechanisms.

The security fix should be installed on all devices that use APT, including servers, workstations, containers, and CI/CD runners. In automated environments, it is also important to update base images. Otherwise, newly created containers or virtual machines may continue running older, vulnerable versions of the package manager.

At the time of publication, there had been no confirmed cases of CVE-2026-109518 being exploited in real-world attacks. Nevertheless, researchers emphasize that the vulnerability is particularly dangerous because it allows attackers to bypass the verification of software packages that users and administrators normally consider trustworthy.