The #Debian APT security update fixes "Download verification bypass" CVE-2026-109518:

"On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified package and achieve remote code execution with root privileges. The vulnerability is caused by the reuse of hard links and requires the client to follow redirects and retry the download of package files. It requires the client to have a non-zero Acquire::Retries configuration setting; the value 3 is the default starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish), so older releases are unaffected in a default configuration"

https://www.cve.org/CVERecord?id=CVE-2026-109518

Obviously any Debian based distribution using APT can be affected as well and should install updates as soon as they become available.

The vulnerability description doesn't mention this explicitly but if your system doesn't have Emudhra certificates purged, they can be vulnerable even when using HTTPS sources.

#CVE_2026_109518 #infosec #cybersecurity

"APT can merge two different package downloads after an HTTP redirect gives them the same URI. Improper file handling when resuming an HTTP download allows a man-in-the-middle attacker to replace a package after verification, resulting in the execution of arbitrary code as root." CVE-2026-109518

Oh, I want to know the details of how this "verification" of a partially downloaded file succeeded.

Anyway, make sure you update your apt, which could be MitM'd, using apt.

https://lists.debian.org/debian-security-announce/2026/msg00526.html

Just released a major APT security update across all it's 11 stable release series. CVE-2026-109518 is a vulnerability that allows an attacker to bypass file verification during download, providing a clear path to running code as root.

Additionally several out-of-bounds accesses and an OOM condition have been addressed.

For a summary of the main bug and the side quests I posted an email summarizing this all:

https://lists.debian.org/deity/2026/11/msg00005.html

Vulnerabilità critica in APT: attacco MITM permette l’esecuzione di codice come Root su Debian e Ubuntu
#Ubuntu #debian #CVE
Scoperta una grave vulnerabilità in APT (CVE-2026-109518) che colpisce Debian e Ubuntu. Un attacco Man-In-The-Middle permette di sostituire pacchetti legittimi ed eseguire codice arbitrario come root durante gli aggiornamenti. Ecco come funziona la falla e come aggiornare subito i tuoi sistemi.

https://www.marcosbox.com/2026/11/04/vulnerabilita-critica-apt-debian-ubuntu-cve-2026-109518/

@sicurezza @linux

Une faille dans APT permet de modifier un paquet après sa vérification de sécurité.

CVE-2026-109518 : un attaquant sur le réseau peut exploiter la reprise des téléchargements HTTP pour exécuter du code en root.

Corrigé dans APT 3.0.4 sur Debian 13

https://www.phoronix.com/news/Debian-APT-MITM-RCE

APT version 3.3.6 has been released, primarily addressing CVE-2026-109518—a download control bypass resolved by enforcing exclusive file access during downloads.

The update also fixes two out-of-bounds issues in the DEB package parser and dependency resolver, adds performance testing improvements, and expands automated test coverage.

Currently available in Debian Unstable (Sid), while Debian Stable and Ubuntu users will not receive…

https://en.hacks.gr/diathesimi-i-nea-enimerosi-3-3-6-gia-dimofiles-ergaleio-diacheirisis-programmaton-se-debian-kai-ubuntu/

#Linux #Debian #Ubuntu #OpenSource

Linux : une faille dans APT permet de remplacer un paquet vérifié et de l’exécuter en root https://www.it-connect.fr/faille-apt-cve-2026-109518-debian-ubuntu-root/ #ActuCybersécurité #Cybersécurité #Vulnérabilité #Linux

A security flaw tracked as CVE-2026-109518 affects APT, the package manager for Debian and Ubuntu.

An attacker positioned to alter HTTP traffic can trick APT during failed download retries into swapping a checked package for a malicious one, achieving root code execution.

Debian and Ubuntu published advisories and fixed builds on November 4, 2026.

Systems using default download retry settings on recent distributions are exposed, and users…

https://en.hacks.gr/keno-asfaleias-se-debian-kai-ubuntu-afinei-perithoria-gia-paremvoles-stis-enimeroseis/

#Debian #Ubuntu #Linux #APT

Debian's Nov 4 DSA-6607-1 fixes APT CVE-2026-109518. With manipulated HTTP downloads and redirects/retries, an on-path attacker could replace a verified package and execute code as root. Debian 13 (trixie) is fixed in apt 3.0.4. Check your distro's advisory and install its security update; exploitation in the wild is not confirmed.

https://lists.debian.org/debian-security-announce/2026/msg00526.html

#Cybersecurity #Infosec #Linux #PatchManagement

Update your Linux systems now to fix CVE-2026-109518, a critical APT package manager flaw that lets on-path attackers run arbitrary code as root.

#Linux #Debian #Ubuntu #Cybersecurity #InfoSec

https://securityonline.info/apt-package-manager-cve-2026-109518-root-flaw/?utm_source=mastodon&utm_medium=jetpack_social

CVSS 4.0 scores APT flaw CVE-2026-109518 at 7.7. A man-in-the-middle attacker or malicious mirror can intercept a package download and replace it with code that runs as root, exploiting the default retry of failed HTTP downloads in Debian 12 and Ubuntu 22.04. Vendor advisories confirm fixes across multiple releases, including long-term support, and note HTTPS sources aren't exposed. #CyberSecurity #Technology

CVE-2026-109518: APT Download Verification Bypass Explained

https://thecybersecguru.com/news/cve-2026-109518-apt-download-verification-bypass/

#infosec #vulnerability #security

CVE-2026-109518 APT vulnerability fixes available | Ubuntu

https://ubuntu.com/blog/apt-vulnerability-fixes-available

Still not fixed... https://ubuntu.com/security/CVE-2026-98432

Hmm, could I talk to the sommelier about this wine?

Sorry the sommelier is on holiday

https://ubuntu.com/security/CVE-2026-98432

At this point I would like to see a postmortem

CVE-2026-98432: kernel Linux, gravità critica (CVSS 3.1: 9.8, Red Hat).

Use-after-free TCP/IPv4: rischio crash e possibile esecuzione di codice da remoto, senza credenziali.

Verifica: uname -r e advisory della distribuzione. Contano anche i backport.

Patch: kernel corretto dal vendor, riavvio e nuovo controllo con uname -r. Disabilitare MPTCP non risolve la falla.

https://nvd.nist.gov/vuln/detail/CVE-2026-98432

Das LLM sagt mir also:

The server is still running a kernel affected by CVE-2026-98432. The fixed kernel is already installed, so the next step is a planned reboot.I verified over SSH that AlmaLinux 9.8 is running 5.14.0-687.29.1.el9_8.x86_64. The installed 5.14.0-687.64.1.el9_8.x86_64 package lists the CVE fix in its changelog.

MPTCP is disabled and the host showed no MPTCP listeners, so the specific exposure the post describes appears absent. The underlying flaw still affects standard IPv4 TCP, and the server has an IPv4 ssh listener.

Nach Absprache mit dem Sohn habe ich die Kiste also gestern abend gebootet und dann nachgefragt.

The server rebooted on November 4 at 19:08 CET and is running 5.14.0-687.64.1.el9_8.x86_64, the kernel with the CVE-2026-98432 fix. Systemd reports zero failed units.

Two services were missing or unavailable when checked:

• Minecraft fabric-lobby was absent from TCP 25574, where the inventory last saw it running. fabric is running on 25572. Both are managed manually.
• friday.... returned HTTP 503 through local Apache. Its configured backend ports, 5173 and 5174, had no listeners. I couldn’t establish whether it was down before the reboot.

Apache, MySQL, SSH, firewalld, Postfix, OpenDKIM, and the inventoried monitoring services were active. Grafana reported its database healthy, InfluxDB answered its health probe, and the expected filesystems were mounted.

Boot logs: mradmin failed three times during startup, with DNS resolution errors for discord.com, then connected successfully.

Systemd ignored an invalid restart policy in wiki.service and an unsupported ImportCredential directive in telegraf.service. Both services are running. The kernel also logged nft_compat deprecation and CPU mitigation warnings.

===

Das ist ein ausgezeichnetes Ergebnis. Der Reboot hat geklappt, das LLM hatte ungefragt ein Verzeichnis der Services angelegt (Im Ansible ist ein docs/ Verzeichnis und es macht sich fleißig Notizen), und das zur Verfikation nutzen können. Und ich habe ein paar Dinge, die ich nach Rückfrage mit dem Sohne aufräumen kann.

Ähnliche Ergebnisse bekomme ich mit den komplexeren Setups meiner eigenen Dedis auch.

I should know never to update the cluster computing class server mid-semester. However I felt like I shouldn't ignore CVE-2026-98432

so of course now I ran some updates and not only does the NVIDIA driver refuse to build but also slurm/MPI pmix support is broken. sigh

I guess I could just make them do the rest of the assignments on the raspberry pi-cluster instead

Kernel security reboots for CVE-2026-98432, a different flaw from last week's Fragnesia reboots: Thursday, Nov 12, 11:00 AM–3:00 PM PST (19:00–23:00 UTC). Our GitLab CI runners reboot one per architecture at a time, so jobs may queue or need a retry, and git.osuosl.org and a few other OSL services are down a few minutes each. Details: https://status.osuosl.org/pages/maintenance/526712bf10cd4e587b000014/6aeb9bd7f7bb4b038d276f4d

Ah, it seems that instead of releasing a fix, Ubuntu has upgraded this vulnerability to "critical"... 🤔

https://ubuntu.com/security/CVE-2026-98432

🛡️ Two open kernel bugs. Local root exploit: blocked with user.max_user_namespaces=0. Remote CVE-2026-98432 (CVSS 9.8, use-after-free in the IPv4 TCP handshake): an nftables rule drops TCP packets carrying IP options, and MPTCP is off.

⚠️ Load that rule in its own table, not via the stock nftables.service: its default config flushes the whole ruleset, Docker's rules included.

The Linux TCP Use-After-Free

#RedHat Patches 9.8-Rated #Linux #TCP #RCE Flaw While #Ubuntu Releases Fixes for Testing

No login, no click, no password: one crafted TCP handshake can corrupt Linux kernel memory outright.

https://thehackernews.com/2026/11/red-hat-patches-98-rated-linux-tcp-rce.html

#CVE-2026-98432

#security #infosec #ai

#infosec #vulnetability #security

CVE-2026-98432 | Ubuntu

CVE-2026-98432 is a vulnerability that affects the IPv4 TCP connection handling in the Linux kernel and can lead to remote code execution. Ubuntu has no patch available yet.

https://ubuntu.com/security/CVE-2026-98432

#infosec #security #vulnerability

GitHub - cybervenom01/Mitigation_CVE-2026-98432:

This nftables configuration ruleset can help mitigate attacks on your hosts that are vulnerable to CVE-2026-98432. The rule can help block incoming IPv4 TCP connections that contain IP options. Regular TCP connections without IP options can still go through. This is a temporary solution until the Linux Kernels are fully patched. · GitHub

https://github.com/cybervenom01/Mitigation_CVE-2026-98432

Das ist jetzt nicht mehr witzig:
Der Patch für CVE-2026-98432 (Score von 9,8/10) ist für Ubuntu "verfügbar" unter "in -proposed", ist also doch doch nicht allgemein verfügbar (außer für Stonking 26.10).
Zur Erinnerung, weil es schon etwas länger her ist: CVE-2026-98432 ist eine kritische Sicherheitslücke im IPv4-/TCP-Netzwerkstack des Linux-Kernels und ein Use-after-free-Fehler. Der Kernel gibt also einen Speicherbereich zu früh frei, obwohl ein anderer CPU-Kern ihn noch verwendet. Angreifende können über speziell präparierte TCP-Verbindungsanfragen die Speicherfehler auslösen.
Im schlimmsten Fall Ausführung beliebigen Codes mit Root-Rechten.
@ubuntu es eilt!

https://ubuntu.com/blog/fixes-available-in-proposed-pocket-for-cve-2026-98432

#ubuntu #canonical #cybersecurity #digitalalltag

Install the Citrix security vulnerabilities update to patch critical Citrix security vulnerabilities affecting XenServer hypervisors and Scout gateways.

#Citrix #XenServer #Hypervisor #Virtualization #CVE202698432 #CVE2026111497 #InfoSec #Cybersecurity

https://securityonline.info/citrix-security-vulnerabilities-xenserver-scout/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-83844 is a High (8.1) vulnerability for Microsoft Paint.

Might have to make the logo in ascii

RE: https://infosec.exchange/@kajer/117560238580690048

PoC for CVE-2026-83844 just dropped 😱

vulnerabilities don't really deserve jeers, all software is/can be vulnerable

... but like really?

https://nvd.nist.gov/vuln/detail/cve-2026-83844

> Out-of-bounds read in Windows Paint allows an unauthorized attacker to execute code over a network.

A remote code exec vulnerability in M$ #Paint(!) just got a rating of 8.1 … what a time to be alive
https://www.cve.org/CVERecord?id=CVE-2026-83844

CISA added Apple WebKit CVE-2024-27834 to KEV on Nov 4 based on exploitation evidence. The pointer-authentication bypass requires prior arbitrary read/write access; it is not standalone web RCE. Apple fixed it in May 2024. Check outdated Apple devices in your fleet. CISA has not identified the attack campaign.

https://www.cisa.gov/news-events/alerts/2026/11/04/cisa-adds-one-known-exploited-vulnerability-catalog

#Cybersecurity #Infosec #Apple #KEV

CISA has officially added CVE-2024-27834 to its Known Exploited Vulnerabilities catalog.

The vulnerability affects Apple operating systems and concerns an authorization bypass mechanism.

Patches for this issue were released by Apple in May 2024.

Reports suggest the flaw is linked to activity by the APT29 group, which has utilized compromised websites and SEO tracking services to facilitate attacks.

Federal agencies are required t…

https://en.hacks.gr/proeidopoiisi-tis-cisa-gia-epitheseis-poy-ypokleptoyn-prosopika-dedomena-apo-syskeyes-apple/

#Apple #CVE_2024_27834 #APT29 #CISA

One of the vulnerabilities mentioned, CVE-2024-27834 is not on the KEV yet. :thinking:

🚨 NEW on CISA KEV — exploited in the wild

🛡 Apple Multiple Products
Apple Multiple Products Improper Authentication Vulnerability
CVE: CVE-2024-27834 · patch by 2026-11-18
📈 EPSS 0.6% exploitation probability

Apple iOS, iPadOS, macOS, Safari, tvOS and watchOS 10.5 contain an improper authentication vulnerability which could allow an attacker with arbitrary read and write capability to bypass pointer authentication.

🔗 https://ninjasignal.ninja/intel/cve/CVE-2024-27834
#cybersecurity #KEV #CVE #infosec

Hackers Exploit Patched Apple Flaw to Deliver Info-Stealing Malware, CISA Says

CISA has added an Apple flaw, CVE-2024-27834, to its Known Exploited Vulnerabilities catalog following reports of active exploitation, The Hacker News reports. The improper authentication flaw, which affects multiple Apple operating systems, is being used to deliver information-stealing malware. https://thehackernews.com/2026/11/hackers-exploit-patched-apple-flaw-to.html

The vulnerability, tracked as CVE-2026-107441, is an out-of-bounds write flaw in the switches' web management interface that allows an unauthenticated attacker with network access to execute operating system commands using specially crafted HTTP requests. https://www.bleepingcomputer.com/news/security/zyxel-fixes-zero-day-exploited-to-hack-nearly-1-000-network-switches/

Binarly believes that Chinese threat actor Red Heron was exploiting a different Zyxel GS1900 vulnerability than CVE-2026-7273, and its patch remained ineffective. They assess that CVE-2026-107441, a pre-auth RCE vulnerability, was exploited in the wild as a zero-day.

https://www.binarly.io/blog/zyxel-gs1900-rce-cve-2026-107441

#china #redheron #cyberespionage #threatintel #eitw #zeroday #IOC

Zyxel fixed CVE-2026-107441 on GS1900 switches. A LAN-side CGI flaw could allow unauthenticated OS command execution. Check the exact model and install its 2.90 firmware patch.

This is separate from CVE-2026-7273, exploited in September; no exploitation of 107441 is confirmed.

https://community.zyxel.com/en/discussion/34523/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-gs1900-series-switches

#Cybersecurity #Infosec #NetworkSecurity

Zyxel has released firmware 2.90 Patch 3 for 10 GS1900 switch models to fix CVE-2026-107441.

The flaw allows an unauthorized user to execute commands with root privileges.

Binarly researchers rate it 9.8/10 and say the previous Patch 2 (CVE-2026-7273) does not stop the new exploit.

Affected models: GS1900-8, 8HP, 10HP, 16, 24, 24E, 24EP, 24HPv2, 48 and 48HPv2.

The brief says there is no workaround for those unable to…

https://en.hacks.gr/krisimi-enimerosi-apo-ti-zyxel-gia-10-montela-diakopton-tis-seiras-gs1900/

#Zyxel #GS1900 #CVE_2026_107441 #FirmwareUpdates

CVE-2026-119977: WordPress-Lücke wird aktiv ausgenutzt

Im WordPress-Kern steckt eine Schwachstelle, über die Angreifer während eines Core-Upgrades Code auf dem Server ausführen können. Die US-Behörde CISA bestätigt Angriffe und hat die Lücke in ihren KEV-Katalog aufgenommen. Betreiber sollten auf WordPress 7.1.4 aktualisieren. Wie das SOC Prime Team berichtet, wurden bereits Ausnutzungsversuche in großem Umfang beobachtet.

https://www.all-about-security.de/cve-2026-119977-wordpress-luecke-wird-aktiv-ausgenutzt/

#wordpress

Kann es sein, dass es noch immer WordPress-Installationen unter Version 7.1.4 gibt?
Macht euch keine Sorgen. Andere werden CVE-2026-119977 bei euch finden.
Viel Glück!

Zum Hintergrund:
Die Schwachstelle beruht auf einer sogenannten Time-of-check-to-time-of-use-Race-Condition (TOCTOU).

Beim vollständigen Upgrade des WordPress-Kerns werden Dateien und Verzeichnisse in einem temporären, öffentlich erreichbaren Verzeichnis bereitgestellt.

Durch die zeitliche Lücke zwischen Prüfung und tatsächlicher Verwendung dieser Dateien können Angreifer unter bestimmten Bedingungen auf diesen Upgrade-Prozess einwirken.

Die Sicherheitslücke ermöglicht unter bestimmten Voraussetzungen eine nicht authentifizierte Remote Code Execution auf dem Webserver.

Besonders problematisch ist, dass dafür kein regulärer WordPress-Benutzeraccount erforderlich ist.

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-core/wordpress-core-470-713-unauthenticated-upgrade-window-staged-installer-remote-code-execution

#WordPress #cybersecurity #digitalalltag

WordPress Update Flaw Is Under Attack, Plus 3 Stories https://raymondtec.com/2026/11/wordpress-update-flaw-under-attack-plus-3-stories/?utm_source=mastodon&utm_medium=social&utm_campaign=daily_brief

Attackers are exploiting a WordPress flaw during core updates. Also: mSecure’s encrypted database theft, patched Zyxel switches, and a refrigeration attack where recovery controls worked.

#TechNews #CriticalInfrastructure #CVE2026119977 #databreach #mSecure #OperationalTechnology #WordPress

Ivanti Connect Secure needs a second patch. CVE-2026-111357/118527 (CISA KEV) chain to unauth root. If you installed the Oct 13 fix, patch again. CISA/Rapid7 name 25.1.1.3 or 22.8R2.6; confirm on Ivanti's advisory, then hunt for compromise.

Also: Linux Fragnesia (CVE-2026-46300), GitLab CVE-2026-97229 and WordPress CVE-2026-119977 (update to 7.1.4).

https://patchorpass.beehiiv.com/?utm_source=mastodon&utm_medium=social&utm_campaign=issue-3

#infosec #vpn #linux #homelab

ESET observed a campaign by the SlippyNunchucks threat group targeting organizations and Chinese-speaking individuals across regions including Hong Kong, Thailand, and Japan.

The operation involved hijacking brand promotion mechanisms in the Windows version of Sogou Input Method to deliver the DarkVigil implant through DLL sideloading and insecure HTTP requests.

Tencent addressed the underlying issue as CVE-2026-120422 by migrat…

https://en.hacks.gr/chaker-paraviasan-dimofili-efarmogi-pliktrologisis-gia-na-parakoloythoyn-ypologistes/

#ESET #Malware #Tencent #Vulnerability

ESET found DNS hijacking redirecting Sogou Input Method's insecure HTTP traffic, leading its own components to run DarkVigil malware. Tencent fixed CVE-2026-120422 in v16.10 on Oct 30. The interception point remains unknown. Inventory affected Windows endpoints and update.

https://www.welivesecurity.com/en/eset-research/slippynunchucks-hijacks-sogou-input-methods-brand-promotion-mechanism-to-distribute-malware/

#Cybersecurity #Infosec #EndpointSecurity #ThreatIntel

Sigh

This is a silly CVE. The Siemens devices shipped Node-RED without authentication, which is Node-RED's default state. It even says so in the docs and tells you to set it up.

Anyway apparently folks are attacking this now.

https://ifin.network/t/cve-2026-58115-no-authentication-on-siemens-simatic-iot2050-node-red/964

#ThreatInte #ThreatIntelligence

Binarly believes that Chinese threat actor Red Heron was exploiting a different Zyxel GS1900 vulnerability than CVE-2026-7273, and its patch remained ineffective. They assess that CVE-2026-107441, a pre-auth RCE vulnerability, was exploited in the wild as a zero-day.

https://www.binarly.io/blog/zyxel-gs1900-rce-cve-2026-107441

#china #redheron #cyberespionage #threatintel #eitw #zeroday #IOC

Zyxel fixed CVE-2026-107441 on GS1900 switches. A LAN-side CGI flaw could allow unauthenticated OS command execution. Check the exact model and install its 2.90 firmware patch.

This is separate from CVE-2026-7273, exploited in September; no exploitation of 107441 is confirmed.

https://community.zyxel.com/en/discussion/34523/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-gs1900-series-switches

#Cybersecurity #Infosec #NetworkSecurity

Zyxel has released firmware 2.90 Patch 3 for 10 GS1900 switch models to fix CVE-2026-107441.

The flaw allows an unauthorized user to execute commands with root privileges.

Binarly researchers rate it 9.8/10 and say the previous Patch 2 (CVE-2026-7273) does not stop the new exploit.

Affected models: GS1900-8, 8HP, 10HP, 16, 24, 24E, 24EP, 24HPv2, 48 and 48HPv2.

The brief says there is no workaround for those unable to…

https://en.hacks.gr/krisimi-enimerosi-apo-ti-zyxel-gia-10-montela-diakopton-tis-seiras-gs1900/

#Zyxel #GS1900 #CVE_2026_107441 #FirmwareUpdates

Install the Citrix security vulnerabilities update to patch critical Citrix security vulnerabilities affecting XenServer hypervisors and Scout gateways.

#Citrix #XenServer #Hypervisor #Virtualization #CVE202698432 #CVE2026111497 #InfoSec #Cybersecurity

https://securityonline.info/citrix-security-vulnerabilities-xenserver-scout/?utm_source=mastodon&utm_medium=jetpack_social