Debian and Ubuntu Fix CVE-2026-109518, an APT Flaw in Download Retries That Lets an On-Path Attacker Install Unverified Packages
Debian, Ubuntu and APT's developers published fixes on November 4 for CVE-2026-109518, which needs an attacker on the HTTP path and a non-zero Acquire::Retries setting.