Tag
#Ubuntu
APT Package-Swap RCE as Root on Debian and Ubuntu (CVE-2026-109518)
APT on Debian and Ubuntu can install an attacker's package after a redirect and a retry, giving an on-path attacker root; fixed in 3.3.6 and 3.0.4.
Nov 05, 2026