CVE-2026-109518: apt Flaw Lets Attackers Swap Packages After Verification and Run Code as Root

CVE-2026-109518 is a critical vulnerability in the APT package manager that allows attackers to swap packages after the verification step, enabling arbitrary code execution with root privileges. The flaw targets the window between package verification and installation, a classic time-of-check to time-of-use (TOCTOU) style attack. The article advises patching vulnerable APT clients immediately to mitigate risk. It also highlights the use of StepSecurity's Harden-Runner tool to detect HTTP-based package downloads and monitor CI/CD pipeline activity for signs of exploitation. The vulnerability poses significant risk to Linux-based systems relying on APT for package management. Supply chain integrity is a key concern, as attackers could substitute malicious packages in automated build and deployment environments. Organizations using CI/CD pipelines are particularly at risk if they download packages over unprotected channels. The article serves both as a technical advisory and a promotion of StepSecurity's tooling for detection and response.