A Linux package manager exists so you don't have to trust the network: Debian signs its metadata, APT verifies every package, and only what checks out gets installed. A flaw disclosed this week breaks that promise at the worst possible moment — after the check passes.

CVE-2026-109518, disclosed by Debian on November 4, lets an attacker sitting between a machine and its package mirror swap a verified package for a malicious one, gaining root when it installs, according to CSO Online. Ubuntu rated it High, CVSS 4.0 7.7; no exploitation in the wild has been reported.

It's a classic time-of-check-to-time-of-use race. As Debian's advisory puts it, "APT can merge two different package downloads after an HTTP redirect gives them the same URI," and "improper file handling when resuming an HTTP download allows a man-in-the-middle attacker to replace a package after verification." A redirect plus a transient error triggering a retry lets the attacker overwrite a verified `.deb` through reused hard links — the check already passed.

It only bites when APT's `Acquire::Retries` is non-zero — the default since Debian 12 and Ubuntu 22.04 LTS, so every stock modern install was exposed. A malicious mirror or proxy counts as on-path, so the threat isn't just hostile Wi-Fi — it's any compromised link in the mirror chain.

The fix is almost comically small: APT maintainer Julian Andres Klode closed it in a one-line commit on October 12 — `methods/*.cc: Open target files exclusively` — unlinking existing files before writing downloads, so writes can't travel through a hard link to an already-verified file. Debian 13 gets it in APT 3.0.4, Debian 12 in 2.6.2, and Ubuntu has shipped patched packages for supported releases.

Then there's the part that should make every security team pause. The researcher who found it, Max Justicz, put it bluntly on X: "I used an AI for two hours and found a zero-day that would let a nation-state hack any server running stock Ubuntu." Flaw discovery is compressing from months of audit to an afternoon with a model — and patching has to keep up.

The advice is unglamorous and urgent: update APT now. Ubuntu recommends disabling retries during remediation (`-o Acquire::Retries=0`) and using HTTPS mirrors, which blocks the traffic manipulation the attack needs. Signatures verify the package you downloaded. This flaw proved the installed package isn't always the downloaded one — and the gap was exactly one hard link wide.

— via CSO Online