{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/apt-advanced-package-tool/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2026-109518"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["APT (Advanced Package Tool)"],"_cs_severities":["critical"],"_cs_tags":["vulnerability","supply-chain","linux"],"_cs_type":"advisory","_cs_vendors":["Debian","Canonical"],"content_html":"\u003cp\u003eA critical vulnerability (CVE-2026-109518) in the Advanced Package Tool (APT) allows attackers to perform a man-in-the-middle (MitM) attack to swap legitimate packages for malicious ones. The attack is successful when APT attempts to retry a failed download, a process that occurs by default in Debian 12 and Ubuntu 22.04 or later, and potentially on earlier versions where users have explicitly enabled 'Acquire::Retries'. The malicious package executes with root privileges during the installation phase.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an unprivileged attacker capable of intercepting or modifying network traffic (e.g., malicious mirror, proxy) to execute arbitrary code as root on the target system during package installation.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate APT to the patched versions provided by the vendor immediately.\u003c/li\u003e\n\u003cli\u003eAudit system configuration files for the 'Acquire::Retries' setting in '/etc/apt/apt.conf.d/' or '/etc/apt/apt.conf'.\u003c/li\u003e\n\u003cli\u003ePrioritize migration of legacy systems to supported distributions to ensure security patch availability.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-04T20:11:55Z","date_published":"2026-11-04T20:11:55Z","id":"https://feed.craftedsignal.io/briefs/2026-11-apt-flaw/","summary":"A critical vulnerability in the APT package manager allows man-in-the-middle attackers to perform package substitution and achieve root-level code execution by exploiting download retry logic.","title":"APT Package Manager: Man-in-the-Middle Arbitrary Code Execution (CVE-2026-109518)","url":"https://feed.craftedsignal.io/briefs/2026-11-apt-flaw/"}],"language":"en","title":"CraftedSignal Threat Feed - APT (Advanced Package Tool)","version":"https://jsonfeed.org/version/1.1"}