Debian Patches apt Flaw Allowing Package Swaps After Verification

Debian's DSA-6607-1, published November 4, 2026, fixes CVE-2026-109518 in apt, found by Max Justicz. A man-in-the-middle attacker, between a user and a server, can exploit apt's merging of two downloads sharing a URI after an HTTP redirect, and mishandled resumed downloads, to replace a package after verification and run code as root. Debian urges upgrades; trixie's fix is apt 3.0.4.