A critical flaw in **APT**, the package manager underpinning **Debian** and **Ubuntu** systems, has been publicly disclosed. This vulnerability enables an attacker to substitute a legitimate package with malicious code, which then executes with root privileges on the target system. According to advisories published by **Debian**, **Ubuntu**, and **APT's developers** on November 4, the attack hinges on **APT** retrying failed downloads. This retry mechanism is enabled by default in **Debian 12** and **Ubuntu 22.04** and later versions. **Debian** has already released patched versions of **APT** to address **CVE-2026-109518**. **APT's developers** have labeled the flaw as critical, and updates for **Ubuntu** and its **Ubuntu Pro** subscription service are being progressively rolled out. Users of **Ubuntu 14.04** with **Ubuntu Pro** can already access the fix. Older releases, such as **Debian 11** and **Ubuntu 20.04**, are not exposed by default. However, **APT's developers** caution that many user scripts might have explicitly enabled the `Acquire::Retries` setting on these older releases, thereby making them vulnerable. As of 14:58 UTC on November 4, **Debian's** testing branch was still running the vulnerable version 3.3.5. For **Debian 11**, whose long-term support ended on August 31, **APT's developers** have provided a fixed version, 2.2.5. **Ubuntu** rates the flaw with a high priority, assigning it a **CVSS 4.0** score of 7.7. The distribution also warns that other distributions built on **Debian** and **Ubuntu** are likely affected. On November 4, at 14:25 UTC, **Ubuntu** released new **APT** builds to its security archive for several of its releases: * **Ubuntu 26.10**: `3.3.3ubuntu0.1` * **Ubuntu 26.04 LTS**: `3.2.1ubuntu0.1` * **Ubuntu 24.04 LTS**: `2.8.4ubuntu0.1` * **Ubuntu 22.04 LTS**: `2.4.15ubuntu0.1` By 15:46 UTC, **Ubuntu** still marked all eight releases it tracks for the flaw, ranging from **14.04 LTS** to **26.10**, as vulnerable. The attack vector involves an adversary capable of modifying HTTP traffic between **APT** and the package server, which could include a malicious mirror or proxy, according to **Ubuntu**. The attack is triggered during package installation, with the attacker using HTTP redirects and temporary server errors to force **APT** into retrying the download, as detailed by **APT's developers**. The flaw was reported by **Max Justicz**. None of the three advisory reports indicate active exploitation of this vulnerability or offer a temporary workaround for systems that cannot be immediately updated. The advisories describe the attack over HTTP and do not specify whether package sources accessed via HTTPS are also exposed.