Man-in-the-middle arbitrary code execution in Debian’s apt

Debian's security advisory DSA-6607-1, published by Salvatore Bonaccorso, reports CVE-2026-109518 in APT, the package manager. Max Justicz found that after an HTTP redirect, APT can merge two different downloads sharing a URI, and improper resume handling lets a man-in-the-middle swap a package after verification, enabling arbitrary code execution as root.…