>On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified package and achieve remote code execution with root privileges. https://ubuntu.com/security/CVE-2026-109518⧉ Apt high vulnerability in Debian 12 onwards and Debian-based distributions. Time to change your sources URIs to HTTPS. I'm done being told HTTP is fine because APT verifies them anyway.