The Same Researcher Broke apt the Same Way Twice, Seven Years Apart

In 2019 Max Justicz showed apt would install a package an attacker swapped in over a redirect. In November 2026 he did it again, CVE-2026-109518, through a different door that ends in the same place: code as root from a man in the middle. The fix shows how apt reuses files on disk.

Read the full article →

Discussion thread — share findings, corrections and follow-ups below.