Debian Fixes apt Flaw That Let Man-in-the-Middle Swap Packages After Verification

Debian's DSA-6607-1, published November 4, 2026, fixes CVE-2026-109518 in apt, found by Max Justicz. A man-in-the-middle attacker can exploit apt's merging of two downloads sharing a URI after an HTTP redirect, and improper handling of resumed HTTP downloads, to replace a package after verification and run code as root. Debian recommends upgrading; trixie's fix is apt 3.0.4.