Careful with “apt upgrade”: hackers can swap verified packages and deliver malware

An attacker sitting between a Linux system and its package mirror can exploit a severe APT flaw to swap legitimate packages, even after the validation that they are safe. Debian and Ubuntu have released security updates.

Debian and Ubuntu have patched a severe flaw in APT, a package manager used by the major Linux distributions.

APT uses unencrypted HTTP for download handling. Attackers-in-the-middle can replace the package after verification, resulting in arbitrary code execution as root.

Security researcher Max Justicz discovered, disclosed, and helped patch this vulnerability, tracked as CVE-2026-109518. The flaw is rated 7.7 out of 10 on the severity scale, but successful exploitation could potentially lead to a complete compromise with little effort.

“An on-path attacker who can manipulate the HTTP traffic between a system and an archive server can trigger the installation of an attacker-controlled .deb package file and obtain root privileges on the target system,” Ubuntu warned in a security advisory.

Normally, the signature scheme would protect against this kind of attack – if a hash doesn’t match, APT refuses to install the package. However, attackers can exploit a flaw in how APT handles interrupted downloads: by default, APT retries a download three times.

“When a package download fails partway through, APT retries it and picks up where it left off instead of starting over,” StepSecurity writes in a report.

How does the attack work?

Researchers detailed three steps an attacker needs to pull off an attack.

The prerequisite is that an attacker take a position on the path between the APT client and the repository. This can be done by operating a malicious mirror, proxy, or by controlling a segment of a network.

First, the attacker intercepts two requests for different packages and redirects them both to the same URL. This tricks the APT into treating two downloads as a single file – creating a hard link between them. Hard links point to the same space (inode) on a storage device.

Second, the attacker temporarily interrupts the downloads – responds with HTTP server errors, forcing APT to retry and resume them.

Third, after APT verifies that the first package is legitimate, APT trusts the hash and mishandles the link – the resumed download overwrites the hard-linked file with the attacker's payload.

APT installs the malicious package with root privileges.

Any apt install or apt-get upgrade command that downloads packages can trigger the attack.

StepSecurity warns that CI/CD infrastructure is particularly at risk.

“On a CI runner, that means access to everything the job can reach: the source code, the GITHUB_TOKEN, cloud credentials, signing keys, and every secret passed to the job. In a Docker build, the attacker’s code ends up baked into an image that is then shipped and run elsewhere,” StepSecurity said.

“On a developer laptop, it means a full compromise of the machine and the credentials stored on it.”

Updates are available

Ubuntu advises users to be extra careful when upgrading their systems to apply fixes for this specific vulnerability, as the usual APT upgrade command could be exploited by attackers on the network to install malware.

Ubuntu recommends running a command that disables retries when upgrading:

sudo apt update && sudo apt upgrade -o Acquire::Retries=0

“Once users update the APT client library on the end-user system, compromised mirrors no longer pose a risk,” the Ubuntu advisory states.

Ubuntu also suggests enabling TLS for those who have concerns about the network path, or as a future precaution.

Debian said in its security advisory that the update addresses several additional out-of-bounds access issues.

APT should be patched on every machine, container, runner, and other client that installs packages.

At the time of writing, no exploitation in the wild had been reported