Debian and Ubuntu APT Flaw Lets MitM Attackers Swap Verified Packages and Run Code as Root

A flaw in APT, the package manager for Debian and Ubuntu, allows an attacker who can modify package downloads to swap a verified package for their own, with the attacker’s code then running as root, The Hacker News reports. Debian, Ubuntu and APT’s developers published advisories on November 4; the attack relies on APT retrying failed downloads, its default behaviour since Debian 12.