The Hot Drop for 11-05-2026

• The vulnerability tracked as CVE-2026-109518 affects Debian, Ubuntu, and their derivative distributions under certain download conditions.
• Debian 12 and later, and Ubuntu 22.04 and later, are exposed to CVE-2026-109518 by default.
• CVE-2026-109518 is a flaw in apt that allows an attacker to swap a package after verification.
• The default Acquire[:][:]Retries value is 3 starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish).
• Older releases of Debian and Ubuntu are unaffected in a default configuration.
• The vulnerability exists in the HTTP backend invoked by the APT library, and affects any APT-based frontend (apt, apt-get, aptitude, or any of the Ubuntu graphical applications).
• Ubuntu 22.04 LTS (Jammy Jellyfish) and newer releases are affected by default; older releases are only affected if the Acquire[:][:]Retries APT configuration setting is set to a non-zero value.
• The bug affects apt, apt-get, aptitude, and graphical software tools, but not Snap packages or FTP sources.
• Older releases such as Debian 11 and Ubuntu 20.04 are not exposed by default, according to Ubuntu.

No background yet from current sources.

CVE-2026-109518 is a vulnerability in the APT package manager that allows attackers to intercept communications between Linux systems and package repositories, install malicious packages, and execute code with root privileges. The flaw affects Debian, Ubuntu, and their derivative distributions under certain download conditions. The vulnerability exists in the HTTP backend invoked by the APT library and affects any APT-based frontend, including apt, apt-get, aptitude, and Ubuntu graphical applications. The bug is located in apt's HTTP download code, so it affects every apt front end, but Snap packages and FTP sources are not affected.

The attack requires APT to retry failed downloads, which is the default behavior from Debian 12 and Ubuntu 22.04 onward. The vulnerability requires the client to retry a failed download, a behavior controlled by the Acquire[:][:]Retries APT configuration setting. Ubuntu 22.04 LTS (Jammy Jellyfish) and newer releases are affected by default, while older releases are only affected if the Acquire[:][:]Retries APT configuration setting is set to a non-zero value. Debian 12 and later, and Ubuntu 22.04 and later, are exposed to CVE-2026-109518 by default.

Older releases such as Debian 11 and Ubuntu 20.04 are not exposed by default, according to Ubuntu. Older releases of Debian and Ubuntu are unaffected in a default configuration. The attacker can be anyone who can change the HTTP traffic between APT and the package server, including a malicious mirror or proxy, according to Ubuntu. Canonical confirms that an on-path attacker can exploit redirects and retried downloads to trick APT into installing an unverified package.

The vulnerability involves HTTP redirects, resumed downloads, and improper file handling that can let attackers replace package contents after verification. An attacker who can tamper with the network traffic between a machine and its package mirror can swap a package after apt has verified it. The attacker's code runs as root, according to advisories published by Debian, Ubuntu, and APT's developers on November 4.

Debian, Ubuntu, and derivative Linux distributions are targeted by the vulnerability. An on-path attacker can trick an APT client into installing an attacker-controlled unverified package on these distributions. The vulnerability allows attackers to intercept communications between Linux systems and package repositories, install malicious packages, and execute code with root privileges. According to advisories published by Debian, Ubuntu, and APT's developers on November 4, 2026, the attacker's code runs as root.

The Debian and Ubuntu advisories reviewed on 2026-11-05 do not report exploitation in the wild. An on-path attacker who can manipulate the HTTP traffic between a system and an archive server can trigger the installation of an attacker-controlled .deb package file and obtain root privileges on the target system.

Detection of CVE-2026-109518 requires monitoring for HTTP redirects, resumed downloads, and improper file handling that allow attackers to replace package contents after verification. Analysts should identify systems where APT is configured to retry failed downloads, as this is the default behavior from Debian 12 and Ubuntu 22.04 onward and is required for the attack to succeed.

Debian fixed the vulnerability in APT 3.0.4 for its stable Trixie distribution. The CVE record lists Debian APT versions before 1.2.36, 1.4.12, and 1.6.19 as affected, with versions 1.2.36, 1.4.12, and 1.6.19 carrying the fix, respectively. The CVE record lists vendor advisory USN-8996-1. Ubuntu recommends updating APT and temporarily disabling retries during remediation.

Additionally, Ubuntu advises using HTTPS for package downloads, which protects against traffic manipulation in this attack scenario.

Five distinct outlets reported on the vulnerability, including ubuntu.com, gbhackers.com, thehackernews.com, stepsecurity.io, and csoonline.com. The disclosure of the issue in Debian's DSA-6607-1 security advisory on November 4, 2026, is reported only by gbhackers.com. The statement that the vulnerability involves HTTP redirects, resumed downloads, and improper file handling is reported only by gbhackers.com. The assertion that Debian fixed the vulnerability in APT 3.0.4 for its stable Trixie distribution is reported only by gbhackers.com.

stepsecurity.io reported that the Debian and Ubuntu advisories do not report exploitation in the wild, and that the specific CVSS v4.0 score of 7.7 and the attribution of a critical rating to the apt maintainers are reported only by that outlet. The statement that Debian 12 and later, and Ubuntu 22.04 and later, are exposed to CVE-2026-109518 by default is reported only by stepsecurity.io. The claim that CVE-2026-109518 is a flaw in apt that allows an attacker to swap a package after verification is reported only by stepsecurity.io. The statement that the bug affects apt, apt-get, aptitude, and graphical software tools, but not Snap packages or FTP sources, is reported only by stepsecurity.io.

thehackernews.com reported that the attack requires APT to retry failed downloads, which is the default behavior from Debian 12 and Ubuntu 22.04 onward, and that older releases such as Debian 11 and Ubuntu 20.04 are not exposed by default. The statement that Debian has released fixed versions of APT for the flaw is reported only by thehackernews.com. The statement that the attacker can be anyone who can change the HTTP traffic between APT and the package server, including a malicious mirror or proxy, is reported only by thehackernews.com. ubuntu.com reported that the vulnerability has been assigned the identifier CVE-2026-109518 and has a severity of High, and that it exists in the HTTP backend invoked by the APT library and affects any APT-based frontend.

The claim that an on-path attacker can trick an APT client into installing an attacker-controlled unverified package is reported only by ubuntu.com. The claim that an on-path attacker can trigger the installation of an attacker-controlled .deb package file and obtain root privileges is reported only by ubuntu.com. The claim that the default Acquire[:][:]Retries value is 3 starting with Debian 12 and Ubuntu 22.04 LTS is reported only by ubuntu.com. The claim that the vulnerability requires the client to retry a failed download, controlled by the Acquire[:][:]Retries setting, is reported only by ubuntu.com.

ubuntu.com noted that Ubuntu 22.04 LTS and newer releases are affected by default, while older releases are only affected if Acquire[:][:]Retries is set to a non-zero value, and that older releases of Debian and Ubuntu are unaffected in a default configuration. The statement that the use of TLS via HTTPS protects against this vulnerability is reported only by ubuntu.com. csoonline.com reported the recommendation to temporarily disable retries during remediation. No confirmed disagreements between outlets were identified.

No timeline updates were identified.

• CVE-2026-7273 is a stack-based buffer overflow vulnerability in the CGI program of Zyxel’s GS1900 firmware versions 2.90(XXXX.1)C0 and earlier.
• Zyxel GS1900 series network switches that received a fix for a flaw later reported to have been exploited in the wild are still open to an exploit attackers used.

No background yet from current sources.

CVE-2026-107441 is a CVSS 8.8 out-of-bounds write vulnerability in the web management interface of Zyxel GS1900 series network switches. The exploit used by attackers relies on CVE-2026-107441 rather than CVE-2026-7273. CVE-2026-7273 is a stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900 firmware versions 2.90(XXXX.1)C0 and earlier. Zyxel GS1900 series network switches that received a fix for a flaw later reported to have been exploited in the wild are still open to an exploit attackers used.

CVE-2026-7273 could allow a LAN-based, unauthenticated attacker to potentially execute OS commands via a crafted HTTP request.

No details yet about who was affected or the impact from current sources.

Attackers used a pre-authentication remote code execution exploit against Zyxel GS1900 switches. According to cybersecurity firm GreyNoise, the attack began around August 17, 2026, but researchers initially blamed a different vulnerability that Zyxel had already addressed. GreyNoise reported that around August 17, 2026, an actor exploited 996 GS1900 switches across 48 countries. GreyNoise attributed the exploitation activity to CVE-2026-7273.

A Chinese-speaking threat actor exploited CVE-2026-7273 to compromise and exfiltrate configuration, networking information, and hashed root-level credentials from nearly 1,000 devices across 48 countries.

No indicators have been published in current sources.

No detection or hunting guidance has been published in current sources.

No mitigation or protection guidance yet from current sources.

Three distinct outlets reported on the exploitation of Zyxel GS1900 switches: csoonline.com, gbhackers.com, and helpnetsecurity.com. All three outlets reported that Zyxel released firmware updates or fixes on October 22, 2026. csoonline.com reported that Zyxel published its advisory on November 3, 2026. helpnetsecurity.com reported that the fix for CVE-2026-107441 is included in the 2.90 Patch 3 firmware releases, whereas the patch for the previously reported flaw fixed a different bug, CVE-2026-7273, from the one, CVE-2026-107441, that the exploit actually relies on.

csoonline.com reported that Zyxel listed firmware versions ending in .2C0 and earlier as vulnerable, with model-specific fixes in versions ending in .3C0, and that the company released a fix for CVE-2026-7273 in June 2026, addressing a separate buffer overflow in the same switch series. helpnetsecurity.com reported that CVE-2026-7273 is a stack-based buffer overflow vulnerability in the CGI program of Zyxel’s GS1900 firmware versions 2.90(XXXX.1)C0 and earlier. csoonline.com reported that the newly identified flaw, tracked as CVE-2026-107441, is a CVSS 8.8 out-of-bounds write vulnerability in the switches’ web management interface. csoonline.com reported that Zyxel patched a zero-day vulnerability that attackers exploited to compromise 996 GS1900 network switches across 48 countries.

gbhackers.com reported that attackers used a pre-authentication remote code execution exploit against Zyxel GS1900 switches. According to cybersecurity firm GreyNoise, as reported by csoonline.com and gbhackers.com, the attack began around August 17, 2026, when an actor exploited 996 GS1900 switches across 48 countries. gbhackers.com reported that GreyNoise attributed the exploitation activity to CVE-2026-7273. helpnetsecurity.com reported that a Chinese-speaking threat actor exploited CVE-2026-7273 to compromise and exfiltrate configuration, networking information, and hashed root-level credentials from nearly 1,000 devices across 48 countries.

According to Binarly, as reported by helpnetsecurity.com, Zyxel GS1900 series network switches that received a fix for a flaw later reported to have been exploited in the wild are still open to an exploit attackers used. No confirmed disagreements between outlets were identified. No timeline updates were identified.

• Businesses in at least 11 countries have reportedly been affected in the most recent attacks, including Belgium, Estonia, Finland, France, Germany, Ireland, Luxembourg, the Netherlands, Portugal, Sweden and the United Kingdom.

No background yet from current sources.

Hackers reportedly compromised refrigeration controllers running older Danfoss software. The attackers reportedly remotely activated automatic defrosting functions on these controllers. The attack reached the Établissement Français du Sang (EFS) through a third-party provider of refrigeration equipment.

A cyberattack targeted a refrigeration equipment provider of the French Blood Establishment (EFS), the only civilian blood collection and transfusion organization in France. Three blood banks detected and reversed a potentially destructive temperature spike in their cold rooms following the attack.

Temperature controls were altered at three of France’s national blood service sites, according to The Record, reported on 2026-11-04. Cold storage rooms in France's National Blood Service (EFS) were turned to a boiling temperature of 110°C (230°F) in a cyber-attack targeting temperature-controlled storage and refrigeration equipment provider Coolworld, according to Infosecurity Magazine, reported on 2026-11-04.

No ATT&CK techniques were identified in current sources.

No indicators have been published in current sources.

No detection or hunting guidance has been published in current sources.

No mitigation or protection guidance yet from current sources.

Four distinct outlets reported on the incident, including the origin source infosecurity-magazine.com and corroborating outlets bleepingcomputer.com, therecord.media, and helpnetsecurity.com. The specific detail that cold storage rooms were turned to a boiling temperature of 110°C (230°F) is reported only by infosecurity-magazine.com. The claim that hackers reportedly compromised refrigeration controllers running older Danfoss software and remotely activated automatic defrosting functions is reported only by bleepingcomputer.com. The statement that U.K. authorities have not attributed the incidents to any group following confirmation that British companies were affected is reported only by therecord.media.

The report that businesses in at least 11 countries have reportedly been affected is stated by therecord.media. The assertion that temperature controls were altered at three of France’s national blood service sites is stated by therecord.media. The confirmation that the EFS’s monitoring and alarm systems identified anomalies ensuring no samples or blood products were altered is reported by helpnetsecurity.com and therecord.media. The statement that no health impacts have been identified and no losses of blood products have been reported is attributed to the Établissement Français du Sang (EFS) by therecord.media.

The statement that the EFS was not targeted directly and that the attack reached it through a third-party provider is attributed to the Établissement Français du Sang (EFS) by therecord.media. No confirmed disagreements between outlets were identified. No timeline updates were identified.

• DigiCert said its Certificate Authority services, CertCentral, and DigiCert ONE were unaffected by the incident.

No background yet from current sources.

On 2025-02-04, DigiCert migrated an internal business system from a network segment restricted by a virtual private network, or VPN, to another availability zone. This infrastructure migration inadvertently allowed the internal business system to be accessible externally.

No details yet about who was affected or the impact from current sources.

No details yet about the attackers from current sources.

No ATT&CK techniques were identified in current sources.

No indicators have been published in current sources.

No detection or hunting guidance has been published in current sources.

No mitigation or protection guidance yet from current sources.

Three distinct outlets reported on the DigiCert data breach: cybersecuritynews.com, gbhackers.com, and bugzilla.mozilla.org. cybersecuritynews.com reported on 2026-11-05 that DigiCert confirmed the unauthorized data access on October 19, 2026, and filed its preliminary incident report the following day. gbhackers.com reported on 2026-11-05 that DigiCert confirmed the reportable breach on October 19. bugzilla.mozilla.org stated that DigiCert confirmed unauthorized access to a subset of archived data on 2026-10-19 and determined it to be a reportable event.

cybersecuritynews.com reported on 2026-11-05 that the exposure began with an infrastructure migration on February 4, 2025, where DigiCert moved the business system to another availability zone. bugzilla.mozilla.org stated that the business system was moved from a VPN-restricted network segment to an availability zone on 2025-02-04, making it externally accessible. cybersecuritynews.com reported on 2026-11-05 that DigiCert confirmed a data breach involving an internal business system that stored customer contact details and identity documents. gbhackers.com reported on 2026-11-05 that DigiCert confirmed unauthorized access to an internal business system containing archived customer information due to a security misconfiguration.

bugzilla.mozilla.org stated that DigiCert identified an event involving unauthorized access to an internal business system used to archive customer information. cybersecuritynews.com reported on 2026-11-05 that DigiCert said its Certificate Authority services, CertCentral, and DigiCert ONE were unaffected by the incident. gbhackers.com reported on 2026-11-05 that DigiCert stated that its certificate authority services, including CertCentral, DigiCert ONE, customer login credentials, and issued certificates, were not affected. bugzilla.mozilla.org stated that DigiCert deployed an authorization fix on 2026-07-02 that remediated account creation and disallowed access to archived data by unassigned accounts.

No confirmed disagreements between outlets were identified. No timeline updates were identified.

• The exploit allowed access to FTP/SFTP credentials for users who logged into the File Manager before detection.
• Customers who used File Manager between approximately August 2026 and October 23 should treat their credentials as compromised.

No background yet from current sources.

The exploit allowed access to FTP/SFTP credentials for users who logged into the File Manager before detection.

According to cybersecuritynews.com, the hosting provider stated that attackers obtained FTP/SFTP usernames and passwords, along with some webmail credentials.

According to DreamHost, an unauthorized third party compromised the server operating files[.]dreamhost[.]com, a web interface customers use to manage website files.

No ATT&CK techniques were identified in current sources.

No indicators have been published in current sources.

No detection or hunting guidance has been published in current sources.

No mitigation or protection guidance yet from current sources.

Two distinct outlets, gbhackers.com and cybersecuritynews.com, reported on the DreamHost data breach. Both outlets reported that DreamHost discovered unauthorized access on October 23, 2026. The investigation identified a potential exposure window stretching back to approximately August 2026. DreamHost confirmed a breach involving its browser-based File Manager that exposed customer credentials.

According to gbhackers.com, an unauthorized third party compromised the server operating files[.]dreamhost[.]com, allowing access to FTP/SFTP credentials for users who logged into the File Manager before detection. In its October 29, 2026 security incident disclosure, DreamHost stated that the entry point was a flaw in third-party software behind File Manager, according to cybersecuritynews.com. No confirmed disagreements between outlets were identified. No timeline updates were identified.

No details yet about the affected products from current sources.

No background yet from current sources.

The attack utilizes three distinct infection vectors: direct JavaScript injection into traffic from legitimate websites, proxy domains, and the supply-chain compromise of a Ukrainian web analytics service. One of the proxy domains used in the attack chain is america250[.]holiday. Class B of the attack chains the vulnerabilities CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, and CVE-2025-43520. All stolen data is sent to the domain ad.starx-net[.]com.

Class A exploit targets iOS 16.7 devices. Class C exploit targets Android phones running Chrome versions 139 to 145, except 143.

No details yet about the attackers from current sources.

Analysts should monitor for network connections to the attacker infrastructure domains ad[.]starx-net[.]com, static[.]flux-telemetry[.]com, edge-ord[.]clouds-stacks[.]com, adsprism-stat[.]com, ads-it-assets[.]com, cdn[.]adv-static[.]com, wpvortex-mod[.]com, assets-int[.]com, and theowo[.]club. Network traffic to the IP addresses 95[.]133[.]231[.]28, 109[.]104[.]106[.]107, 192[.]121[.]46[.]25, 195[.]58[.]140[.]105, and 188[.]190[.]17[.]232 should be reviewed for potential compromise. File integrity monitoring should check for the presence of files with the SHA-256 hashes a7d2493df00565c21587b0cad2a9fe7ca1e5590acf796da6e499be0ffde44cc3, bee3e014e3df87ddce0250b0985b87f6868a427a7b650a74b7ffedb9d57f3088, c170fda024183645c0aa681149304e50506509c3498bb6b9a5f5ced6aa73e5fa, 2ffb35e3f9e55286a930fb887e73764a913166648135fe0ca7551736d97d7bfa, 69b6cb327a4d5da99399718f6a66f84de69f89425b0a31f2dcee0682f811596f, 29d283ebd08d0cd3b2e6f4a67718d3d6e7a6be01d0613d716bce218dba57a928, 06c17b31d36838f3d29044784aa047d5c2d9174d3356c1211cf25f9df677445f, 183d62d682aea8018491c8559544e8d6a9ab0e1abd05ecbb6c97daa4f438d2b8, and 387a7fb768db1350a9788d9704e7a72abe07152734e0ff026af72b417e36268c.

No mitigation or protection guidance yet from current sources.

Two distinct outlets, cybersecuritynews.com and arstechnica.com, reported on the incident. cybersecuritynews.com reported on 2026-11-04 that Class C exploit targets Android phones running Chrome versions 139 to 145, except 143. cybersecuritynews.com reported on 2026-11-04 that all stolen data is sent to ad.starx-net[.]com. cybersecuritynews.com reported on 2026-11-04 that Class B chains CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, and CVE-2025-43520.

cybersecuritynews.com reported on 2026-11-04 that Class A exploit targets iOS 16.7 and steals cookies using CVE-2025-43529 and CVE-2024-27834. arstechnica.com reported on 2026-11-04 that the hackers relied on three infection vectors: direct JavaScript injection, proxy domains, and supply-chain compromise. No confirmed disagreements between outlets were identified. No timeline updates were identified.