APT CVE-2026-109518 package-swap RCE and OpenSSH 10.6p2 password bypass fix

APT: unverified package install via redirects and retries (CVE-2026-109518)

• What: An on-path attacker who can tamper with HTTP traffic between an APT client and the archive (including a malicious mirror or proxy) can trick the client into installing an attacker-controlled, unverified package, giving root code execution. It needs the client to follow redirects and retry downloads with a non-zero Acquire::Retries; the default of 3 starts with Debian 12 (bookworm) and Ubuntu 22.04, so older releases are unaffected in a default configuration. NVD, Debian security tracker
• Severity: High, CVSS 4.0 7.7 (Ubuntu CNA).
• Exploited: Not on CISA KEV.
• Fixed in: apt 2.6.2 for bookworm (DLA-4880-1), 3.0.4 for trixie (DSA-6607-1), 3.3.6 in unstable.
• What to do: Update apt on Debian 12/13 hosts and rebuild container images based on them. Until then, set Acquire::Retries "0"; and prefer HTTPS mirrors.

OpenSSH 10.6p2: password authentication bypass on musl without PAM

• What: OpenSSH says portable 10.6p2 (2026-11-05) contains a critical security workaround for an sshd password authentication bypass on Linux systems built and run with musl libc and PAM disabled, such as some Alpine-based systems and containers. No CVE ID was listed in the release notes. OpenSSH release notes
• Severity: Described by OpenSSH as critical; no CVSS score published yet.
• Exploited: No confirmed exploitation reported.
• Fixed in: OpenSSH 10.6p2.
• What to do: Upgrade sshd on musl-based systems, or disable PasswordAuthentication and use keys only until patched. glibc-based distributions with PAM enabled are not described as affected.