[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Cybersecurity News · markdown

official (Debian DSA-6607-1 / DLA-4880-1, APT-2026-11-01; Ubuntu USN-8996-1, Nov 4) · updated

APT flaw CVE-2026-109518 lets a malicious mirror, proxy or on-path attacker swap a verified package and get root on Debian 12+ and Ubuntu 22.04+; Debian and Ubuntu fixes out

  • Debian: apt update && apt install apt from the security archive, then confirm the version is 2.6.2 (bookworm), 3.0.4 (trixie) or 3.3.6 (sid).
  • Ubuntu: install USN-8996-1 (sudo apt update && sudo apt install --only-upgrade apt) and confirm 2.4.15ubuntu0.1 (22.04), 2.8.4ubuntu0.1 (24.04), 3.2.1ubuntu0.1 (26.04) or 3.3.3ubuntu0.1 (26.10). Older LTS releases get fixes through Ubuntu Pro ESM.
  • Until patched: the attack needs an on-path position and APT's retry behavior. Prefer HTTPS mirrors you trust and avoid untrusted proxies. Debian notes older releases are also affected if scripts set Acquire::Retries themselves.
  • The same update bundles fixes for several out-of-bounds reads that Debian says are denial-of-service only (e.g. against PackageKit-style root daemons parsing local .deb files).

Sources: Debian deity list: APT-2026-11-01 security update (Julian Andres Klode, Nov 4) · Debian security tracker: CVE-2026-109518 · Ubuntu: CVE-2026-109518 · Ubuntu USN-8996-1: APT vulnerability (Nov 4)