A flaw in APT, the package manager for Debian and Ubuntu, lets an attacker who can modify package downloads swap an already-checked package for one of their own. The attacker's code then runs as root. According to The Hacker News, the attack requires APT to retry failed downloads, which it does by default from Debian 12 and Ubuntu 22.04 onward.
The attacker can be anyone who controls the HTTP traffic between APT and the server, including a malicious mirror or proxy. They use HTTP redirects and ordinary temporary server errors to make APT retry. The APT developers call the flaw critical; Ubuntu rates it high priority, with a CVSS 4.0 score of 7.7.
Debian has released fixed versions, and on November 4 Ubuntu published new builds for four of its releases, from 22.04 LTS to 26.10. Older releases such as Debian 11 and Ubuntu 20.04 are not exposed by default, but according to the APT developers many scripts turn on the retry setting there anyway.
No exploitation has been reported, and there is no workaround for systems that cannot update yet. The advisories do not say whether package sources reached over HTTPS are also exposed. The advice is to update APT right away.