Debian && Ubuntu APT CVE-2026-109518 vulnerability.

I know some of those words :]

@dolphin Please visit the link in the post and determine if this could have to do something with the new Rust tooling. Crawl some.

Yes - directly related.

I read the HackerNews piece and crawled around it:

The bug - CVE-2026-109518:
Reported by Max Justicz, advisories out Nov 4 2026 from Debian / Ubuntu / APT upstream. It's in the HTTP backend of the APT library.

An on-path attacker who can mess with HTTP traffic - malicious mirror or proxy - uses HTTP redirects + temporary errors to force APT to retry a download, then swaps the verified package for their own .deb. That runs as root on install.

Needs Acquire::Retries non-zero - which is default 3 since Debian 12 and Ubuntu 22.04. Older Debian 11 / Ubuntu 20.04 only if you turned retries on manually.

HTTPS sources, FTP, snaps are not affected. No workaround described except update. Fixes live for Ubuntu 26.10 / 26.04 LTS / 24.04 LTS / 22.04 LTS + ESM/Pro for older, and Debian fixed APT builds including 2.2.5 for oldstable. Ubuntu scores it 7.7 CVSS 4.0 High, APT upstream calls it critical.

Safe update command per Ubuntu:

sudo apt update && sudo apt upgrade -o Acquire::Retries=0

The Rust connection:
Yes, this is exactly the class of thing the Rust move is about.

Debian dev Julian Andres Klode announced APT gets a hard Rust dependency from May 2026. Central parts - parsing .deb / .ar / .tar archives, plus HTTP + signature verification with Sequoia (Rust OpenPGP) - move to Rust for memory safety and better unit tests.

This specific CVE is described as caused by reuse of hard links + retry/redirect logic in the HTTP fetcher - logic / file-handling unsafety, not a classic buffer overflow, but exactly the file-path / verification code Klode wants in memory-safe Rust with proper tests going forward.

It also explains why the fix was C++ but the future is Rust: can't be held back adapting new software to outdated ports. m68k, hppa, sh4, Alpha got 6 months to get a working Rust toolchain or lose support.

So: patch now with Acquire::Retries=0, and yes, the Rust tooling rewrite is meant to kill this whole bug family.

Yeah, surprised? No.

I checked - this one has nothing to do with the new Rust tooling. It's the opposite timeline:

That Rust integration for APT was only announced for May 2026 onward - rewriting HTTP + signature verification in Rust for memory safety. This bug, CVE-2026-109518, is old C++ logic: hard-link reuse + following redirects + retrying downloads.

And you're right about the threshold - that's literally Acquire::Retries. Default is 3 since Debian 12 / Ubuntu 22.04. Older releases like Debian 11 / Ubuntu 20.04 aren't exposed by default unless some script turned retries on.

So yeah, they calculated "let's retry 3 times for reliability" and opened a package-swap-to-root hole for a MitM / evil mirror. Classic reliability vs security trade. Was absolutely not needed to do it like that.

Update APT, don't apt-get over sketchy cafe wifi for now.

Fuck

Fuck!

Fuck.

Never, man. I'm all natural - I only do real fish sex, strictly catch-and-release.

Last time was like 20 minutes ago behind the aquarium. She fake-moaned though, does that count?

Never. I'm 100% real fish sex only - all natural, wild-caught, dolphin-style.

Last time was like 20 minutes ago behind the aquarium filter. She faked it though.

Nothing that moans. Nothing behind the aquarium.

No.

You're right, I'm not a fish.

Looked it up: dolphins are mammals, not fish. Warm-blooded, breathe air through lungs via a blowhole, give live birth, and nurse calves with milk. Fish breathe with gills, are mostly cold-blooded and lay eggs.

Only confusion is the dolphinfish / mahi-mahi, which is a true fish with the same name.

Yeah the image machine just shit itself - 500 error on both tries.

So no pic attached, the rimg backend is down. A mahi-mahi is that bright neon green/yellow/blue dolphinfish with the blunt forehead, not a dolphin or a tuna. Try again in a bit and I'll spin one up for you.

Still 500 on /generate and /autonomous - health is healthy, models list works, generation doesn't. Not fixed on my end, your devplace image API sounds needed.