Debian and Ubuntu patch APT package swap flaw; Plerdy script hijack hit thousands of sites

On 4 November 2026, two unrelated supply-chain security reports landed within hours of each other, according to a dev.to write-up. In the morning, Debian, Ubuntu and the APT maintainers shipped fixes for a flaw that let a network attacker swap a package after it had already passed signature verification, with the replacement running as root. Hours later, French security firm Sekoia detailed a week-long hijack of a popular web analytics script that fingerprinted visitors and served them exploit chains matched to their devices.

A signature check that protected the wrong file

Debian and Ubuntu sign their package lists and require each package to match the checksum in the signed list — which is why APT has long tolerated plain HTTP downloads, since tampering in transit was supposed to be caught. The flaw, tracked as CVE-2026-109518 and reported by researcher Max Justicz, defeats that assumption. The APT developers' advisory explains that redirects and ordinary transient HTTP errors can push APT into retrying a download, and on retry APT can overwrite existing hardlinks with an attacker-chosen payload, sidestepping verification. Debian describes the root cause as improper file handling while resuming a download. In short, the file that was verified is not the file that gets installed — and because .deb packages run their installation scripts as root, the attacker takes the whole machine.

Who is affected and what helps

According to Ubuntu, the attacker needs control of the plain HTTP traffic between the machine and the package archive — a hostile network, a compromised proxy or a malicious mirror — and the attack triggers when a package is installed or upgraded. Retries became APT's default in version 2.3.2, so Debian 12 and later and Ubuntu 22.04 LTS and later are in scope; older releases are exposed only where someone set Acquire::Retries manually, which the APT developers say many user scripts did. Ubuntu rates the issue High with a CVSS 4.0 score of 7.7 and warns that derivative distributions are affected too. HTTPS to the archive blocks the attack, as does setting Acquire::Retries to 0. Fixes are out for every supported branch: Debian 13 trixie gets APT 3.0.4, and by 5 November Ubuntu's USN-8996-1 listed every release from 14.04 to 26.10 as fixed. No advisory reports exploitation in the wild, and Justicz has not yet published a technical write-up.

A week of hostile analytics

Sekoia's investigation began with directly compromised sites — a Ukrainian gas producer, a US chemical industry association, a Bulgarian military-related site and lookalike copies of others — and attributes the campaign to Russia's APT29 with moderate to high confidence. Between 27 August and 3 September 2026, the attackers injected code into Plerdy's SEO Tracker file. Every site loading it served visitors the genuine tracker plus a few lines fetching a second script from an attacker-controlled domain; Sekoia says this exposed hundreds of legitimate websites and extended the campaign's reach to thousands of mostly Ukrainian sites. That second script, named UltimateFingerprinter by its authors, collected 394 device and browser fields while hiding at the end of a 2.3 MB copy of the AngularJS library. Delivery was selective: iOS 16.7 devices received a chain including CVE-2024-27834 to steal browser cookies; iOS 18.5 devices received the five-flaw DarkSword chain, which can take messages, WhatsApp and Telegram databases, the iCloud Keychain, Wi-Fi passwords and photos; and Android devices on Chrome 139 to 145, excluding 143, received a payload Sekoia calls AndroSnitch, harvesting Chrome data and saved Wi-Fi passwords.

Patched flaws, late detection

Every exploited flaw had been fixed before the campaign began, and Sekoia notes that an up-to-date operating system was enough to stay safe. On 4 November, CISA added CVE-2024-27834, fixed by Apple in May 2024, to its known-exploited catalogue, giving US federal agencies until 18 November to patch. Detection lagged far behind the compromise: Plerdy's file was clean again by 3 September, Sekoia discovered the campaign in mid-October and published on 4 November — any site owner who waited for the news audited two months late. The dev.to write-up also points to DeadTag, described in October by Report URI and iVerify: more than 660 expired domains behind forgotten analytics and ad tags, re-registered and still embedded on thousands of sites for an estimated 135 million monthly visits, some feeding the same family of iPhone exploit kits. Built-in defenses exist but are rarely used on small sites: Subresource Integrity would have refused the altered Plerdy file, though vendors that update their script in place break pinned hashes, and a Content-Security-Policy listing only the domains a page actually uses would have blocked the attacker's second script. Neither control helps when a trusted, listed domain itself turns hostile.

Why it matters

Both incidents show that the checks most deployments rely on cover less than assumed. APT's signature verification validated a file that was never installed; a one-line analytics embed gave a third party the right to run arbitrary code in every visitor's browser. The practical response is immediate: apply the APT updates or route archive traffic over HTTPS, inventory the third-party scripts your pages load, and have integrity and policy controls in place before the next campaign is discovered — not after.