APT 3.0.4 Blocks MITM Root-Code Execution

// 1h agoSECURITY INCIDENT

APT 3.0.4 Blocks MITM Root-Code Execution

Debian patched CVE-2026-109518, a flaw allowing man-in-the-middle attackers to replace verified packages and execute arbitrary code as root. Debian stable users should upgrade APT to 3.0.4.

// ANALYSIS

This undermines the trust boundary package managers are supposed to provide, making prompt patching especially important for servers, CI runners, and build infrastructure.

–Redirect handling could merge distinct downloads under one URI.
–Improper resume logic enabled package substitution after verification.
–The vulnerability requires an on-path attacker but ends in root-level code execution.
–APT 3.0.4 also addresses several out-of-bounds access issues.
–Developers should audit pinned container and VM images that may ship older APT versions.

// TAGS

aptsecurityopen-sourcedevtoolcli

DISCOVERED

1h ago

2026-11-04

PUBLISHED

2h ago

2026-11-04

RELEVANCE

7/ 10

AUTHOR

SG-

// KEEP READING

More AI developer news from the feed

EXPLORE FULL FEED

FUNDING26m ago

HumanLayer Joins Factory’s Software Factory

HumanLayer is joining Factory, bringing its multiplayer coding-agent IDE, cloud orchestration, and team collaboration workflows into Factory’s broader autonomous software-development platform.

UPDATE32m ago

Zed 1.27 Ships Leaner Agent Workflows

Zed 1.27 improves Agent Panel efficiency by loading thread diffs and Markdown on demand, while reducing CPU usage and disk reads during long agent sessions. The release also adds Go 1.27 syntax highlighting and repository-style AI commit messages.

UPDATE39m ago

Tesseract Adds Agent-Controlled 3D Scenes

Mirage says Tesseract now lets AI agents build, animate, and render 3D scenes by directly controlling geometry, materials, lighting, motion, and camera perspective. The approach targets editable, deterministic scene creation instead of one-shot video generation.