Debian patches apt flaw letting MITM attackers swap packages post-verification for root
jedisct1 · x · 2026-11-05
Debian issued DSA-6607-1 for CVE-2026-109518, an apt vulnerability found by Max Justicz. After an HTTP redirect gives two package downloads the same URI, mishandled download resumption lets a man-in-the-middle attacker replace a package after verification, yielding arbitrary code execution as root. Fixed in apt 3.0.4 on trixie; users urged to upgrade immediately.
More from Infra
- Indie pretraining run hits 10T tokens of data, locks in Apple M5 and DGX Spark support — jon_durbin · 2026-11-05
- HunyuanVideo 1.5 T2V FP8 outputs noisy images on AMD RX 7900 XTX — Fragrant-Throat7048 · 2026-11-05
- Bloomberg columnist urges data center builders to read his overlooked deep-dive — asusarla · 2026-11-05
- Google launches AlloyDB Express: 2-second Postgres provisioning with scale-to-zero for coding agents — rseroter · 2026-11-05
- SGLang Summit 2026 agenda: LinkedIn serves ads model at 10K QPS, NVIDIA brings SGLang to Vera Rubin — DavidBennett__ · 2026-11-05
- A top-tier 28-minute explainer on the structural differences between GPUs, TPUs and Groq's LPU — yacinelearning · 2026-11-05