Package Manager

Security incidents tagged Package Manager. Newest first.

1 Package Manager incident in the last 12 months

Critical 4 · High 3 · Med 2 · Low 1 · Update ½Severity-weighted: critical 4 · high 3 · medium 2 · low 1 · update ½LessMore

Brought to you byTinkerer Club

The private club for people who own their servers, run their own AI, and pay $0/month for software.

Patched
Debian APT man-in-the-middle can swap a package after verification and run code as root (CVE-2026-109518)
A flaw in APT, Debian's package manager, lets a man-in-the-middle attacker replace a package after it has been verified, resulting in arbitrary code execution as root. Per Debian's advisory DSA-6607-1, APT can merge two different package downloads after an HTTP redirect gives them the same URI, and improper file handling when resuming an HTTP download allows the swap. It was found by Max Justicz. Debian stable (trixie) is fixed in apt 3.0.4, which also addresses several out-of-bounds access issues. Debian's advisory does not mention exploitation, and Ubuntu and other apt-based distributions had not published their status when this was added.
APT package manager (Debian)Since Nov 4, 2026updated Nov 4, 2026, 13:57 UTC