Security
APT flaw CVE-2026-109518 lets a rogue mirror or proxy swap Debian and Ubuntu packages for root. How to patch safely
A bug in APT, the package manager behind Debian, Ubuntu and their derivatives, lets an attacker who can tamper with HTTP downloads slip in an unverified package that runs as root. Fixed APT builds shipped on November 4; servers, desktops and container images on Debian 12, Ubuntu 22.04 or newer should update, ideally with retries switched off while they do.