Cyber ·
CVE-2026-109518: remote code execution in apt(1) (DSA 6607-1)
Debian security advisory on an APT flaw that may allow a man-in-the-middle attacker to replace a package during handling of redirected HTTP downloads, with possible remote code execution.
Radar bookmark, category cyber. The source is a machine translation of a post on the oss-sec list dated 4 November 2026, by Jan Schaumann, who recommends sharing the Debian Security Advisory DSA 6607-1 about CVE-2026-109518 in apt(1), the package manager. According to the advisory, Max Justicz found that APT can combine two different package downloads when an HTTP redirect causes them to have the same URI. Incorrect file handling when resuming an HTTP download allows a man-in-the-middle attacker to replace a package, and the advisory title indicates remote code execution. Relevance: this is an operating system software update issue with no direct connection to the Rota Nacional platform, which does not patch third-party packages or sit in that chain. To verify, consult the original Debian advisory through the official Debian security channel, confirm the fixed apt package version stated there, and compare it with the version installed on your servers. The source does not state affected versions, so we do not assume them here.
Original source: CVE-2026-109518: execução remota de código no apt(1) (DSA 6607-1)