APT flaw on Debian and Ubuntu lets MitM attackers swap packages and run code as root

What happened

On November 4, 2026, Debian and Ubuntu published advisories for a flaw in APT, the package manager used on both distributions. An attacker who can modify package downloads in transit (a man-in-the-middle position) can replace a package that APT has already verified with a different one. Because packages are installed with root privileges, this leads to code execution as root on the affected system.

The attack depends on APT's download retries. Retries are enabled by default starting with Debian 12. There are no reports of active exploitation at this time.

Who is affected

• Servers running Debian or Ubuntu where APT retries are enabled, which is the default from Debian 12 onward.
• Systems that download packages over a network path an attacker could tamper with, for example untrusted networks, shared hosting networks, compromised routers or proxies, or plain HTTP mirrors.

The exact affected and fixed APT versions are not included in our source data. Check the Debian and Ubuntu advisories via the reference linked below for the versions that apply to your release.

What to do now

1. Look up the fixed APT version for your distribution and release in the Debian or Ubuntu security advisory.
2. Install the update from a network path you trust, ideally over HTTPS mirrors or from inside your own trusted network:

   sudo apt update
   sudo apt install --only-upgrade apt
   

3. Confirm the installed version matches the fixed version from the advisory:

   apt --version
   dpkg -l apt
   

4. Until every server is updated, avoid running package installs or upgrades over untrusted networks. As a temporary measure you can disable APT retries, which the attack depends on, by creating /etc/apt/apt.conf.d/99no-retries with the line Acquire::Retries "0";. Remove it again once APT is patched if you rely on retries.
5. Prefer HTTPS mirrors in your sources lists (/etc/apt/sources.list and /etc/apt/sources.list.d/) where your mirror supports it.
6. Roll the update out to all Debian and Ubuntu servers, containers and base images you maintain, including automation such as unattended-upgrades and image builds.

How to check whether you are affected

• Compare the output of dpkg -l apt with the fixed version listed in the advisory for your release. If your version is older, the server is affected.
• Check whether retries are configured: apt-config dump | grep -i retries. On Debian 12 and later they are on by default even if no explicit setting appears.
• Review recent package activity for installs or upgrades you do not recognise: /var/log/apt/history.log and /var/log/apt/term.log, and /var/log/dpkg.log.
• If a server installed packages over an untrusted network before it was patched and you see unexpected activity, treat it as potentially compromised: look for unknown users, cron jobs, systemd units and SSH keys, and consider rebuilding it from a known good state. Note that tools like dpkg --verify compare files against the installed package's own checksums and will not reveal a package that was swapped as a whole.

Sources

• https://thehackernews.com/2026/11/debian-and-ubuntu-apt-flaw-lets-mitm.html