APT Flaw CVE-2026-109518: How Hackers Can Swap Verified Packages (Explained Simply)

Every Linux user types sudo apt update && sudo apt upgrade without thinking twice. Now imagine that one day this same command quietly installs a malware package on your machine, and APT still says “all verified, all good”. Sounds scary, no? That is exactly what the new APT flaw (CVE-2026-109518) made possible.

Debian and Ubuntu released fixes on 4 November 2026. In this post, let’s understand the APT flaw in simple words: what it is, how the trick works, who should worry, and what you should do today.

What is the APT flaw in simple words?

APT is the package manager behind commands like apt install and apt-get upgrade on Debian, Ubuntu and many other Linux systems. It downloads software packages from a repository (a mirror) and checks each package using a hash, which is like a fingerprint. If the fingerprint does not match, APT refuses to install the package.

The APT flaw breaks this safety in a clever way. An attacker who sits in the middle of your network path can make APT verify a good package first, and then replace it with a bad one before the install step. The check passes, but the wrong file gets installed. Since APT installs packages as root, the malware gets full control of the system.

How the APT flaw attack works, step by step

The bug is in how APT handles a download that gets interrupted. By default, APT can retry a failed download and continue from where it stopped. The attacker abuses this retry feature. Here is the idea in simple steps:

1. Redirect two requests to one URL. The attacker catches the requests for two different packages and sends both to the same URL. APT now treats them like one download linked to the same file.
2. Cause a small interruption. The attacker returns temporary server errors, so APT thinks the download failed and starts its retry.
3. Swap after verification. APT first verifies the genuine package and trusts its hash. Then the resumed download overwrites the linked file with the attacker’s payload, and APT installs it.

TOCTOU: the idea behind this bug

Security people call this a time-of-check to time-of-use (TOCTOU) bug. Let’s take a simple example. A security guard checks your parcel at the gate and says “ok”. But before the parcel reaches your table, someone changes the box inside. The guard did his job properly, but he checked the box before the swap.

Same here. APT’s hash and signature checks work fine, but they check a file that can change before it is used. So the problem is not weak cryptography. The problem is the gap between checking and installing.

Who is at risk from this APT flaw?

The attacker needs to control some part of the network path between your machine and the package server. This can be a malicious mirror, a bad proxy, or a compromised network segment. Because APT downloads packages over plain HTTP by default, such an attacker has a chance to interfere. Packages from Snap and FTP sources are not affected.

• CI/CD runners: an attacker could reach source code, access tokens, cloud credentials, signing keys and job secrets.
• Docker builds: malicious code can get baked into an image, which then runs on many other servers.
• Developer laptops: full compromise of the laptop and the credentials saved on it.
• Older Ubuntu releases: Ubuntu 20.04 and older default to zero retries, so they are exposed only if someone raised the retry setting. CI scripts and Dockerfiles often do exactly that.

Good news: at the time of reporting, no attack in the wild was reported. The flaw has a CVSS v4 score of 7.7 (High), though the APT maintainers treat it as critical. Credit for finding it goes to researcher Max Justicz.

Which APT versions have the fix?

Ubuntu 20.04 and older LTS releases get the fix through Ubuntu Pro.

What should you do now about the APT flaw?

Do not panic, but do not delay either. Follow these steps in order.

Step 1: Check your APT version and retry setting.

apt list --installed '?source-package(^apt$)'
apt-config dump | grep -i 'Acquire::Retries'

Step 2: Upgrade APT itself with retries switched off. This way the update does not depend on the risky retry behaviour.

sudo apt-get update
sudo apt-get install -y -o Acquire::Retries=0 --only-upgrade apt

Step 3: If you cannot patch today, turn off retries for now.

echo 'Acquire::Retries "0";' | sudo tee /etc/apt/apt.conf.d/99-no-retries

Step 4: Fix your pipelines too. Patching the laptop is not enough. Rebuild your runner images and Docker images so that new machines also start with the fixed APT. For Docker, build with fresh layers:

docker build --pull --no-cache .

Step 5: Prefer HTTPS for APT sources. It blocks the on-path trick, but it does not help against a malicious mirror or a proxy that opens TLS traffic, so patching is still a must.

Also read our earlier explainers on the WordPress core flaw that targets sites during updates and the Ivanti Connect Secure zero-days. Update-time attacks are becoming a pattern.

Quick self-test: check your understanding

Try to answer in your mind first, then tap to see the answer.

Key takeaways

• The APT flaw (CVE-2026-109518) lets an on-path attacker swap a verified package with a malicious one.
• The trick uses APT’s retry and resume feature, not a weakness in hashes or signatures.
• The attacker must control part of the network path, such as a malicious mirror or proxy.
• CI/CD runners, Docker builds and developer laptops carry the biggest risk.
• Debian and Ubuntu fixed it on 4 November 2026. Update APT on every machine and rebuild your images.
• Until patched, set Acquire::Retries to 0.

FAQ on the APT flaw

Sources