Debian and Ubuntu APT Flaw Lets MitM Attackers Swap Verified Packages and Run Code as Root

thehackernews.com Nov 4, 2026

Debian and Ubuntu APT Flaw Lets MitM Attackers Swap Verified Packages and Run Code as Root

Curated by Shubham · TechCapsules · Nov 4, 2026

AI-summarised brief · reviewed before publication

A critical flaw in Debian and Ubuntu’s APT package manager (CVE‑2026‑109518) lets attackers swap verified packages with malicious ones when APT retries failed downloads. The vulnerability, active from Debian 12 and Ubuntu 22.04 onward, allows code to run as root. Debian and Ubuntu have released patched APT versions, with Ubuntu Pro users of older releases also receiving updates. The flaw is exploitable via compromised mirrors or proxies and affects all distributions built on Debian and Ubuntu.

💡 Why It Matters

· The flaw exposes the core software supply chain, enabling attackers to gain root access on any system that relies on APT’s default retry logic.
· This threatens the integrity of the entire Debian/Ubuntu ecosystem and any derivatives that depend on it.

Capsules Cybersecurity

Read full article on thehackernews.com

IonQ Completes $1.15B Acquisition of Elisity to Integrate Zero Trust with Quantum…

Trapped‑ion quantum computing company IonQ completed a $1.15 billion all‑stock acquisition of cybersecurity firm Elisity, Inc. The deal includes an earnout of up to $150 million tied to revenue milestones through January 2028. Elisity’s identity‑based network microsegmentation software will be paired with IonQ’s post‑quantum cryptography and quantum key distribution roadmap, giving IonQ immediate access to corporate IT security budgets. The transaction follows IonQ’s recent purchase of SkyWater Technology, expanding its revenue base beyond scientific computing.

💡 By merging quantum‑safe encryption with proven zero‑trust software, IonQ positions itself to meet upcoming federal post‑quantum compliance mandates and capture a growing enterprise security market.

thehackernews.com · Nov 4

SonicWall Won’t Patch EoL GMS Flaws That Could Expose Files, Alter Database…

SonicWall announced that it will not issue patches for two security vulnerabilities affecting its end‑of‑life Global Management System (GMS) versions 9.5.2 and earlier. The company stated that because the product is EoL, no remediation will be released and urged users to upgrade to the SonicWall Network Security Manager (NSM). The decision follows a recent critical SSRF flaw (CVE‑2026‑102255) that has been actively exploited, with over 2,500 attack attempts recorded since October 9, 2026.

💡 The lack of fixes leaves existing GMS deployments exposed to known exploits, forcing organizations to migrate or face heightened risk of unauthorized internal access.

thehackernews.com · Nov 4

China-Aligned Hackers Hijack Sogou Input Method DNS Requests to Deploy DarkVigil Backdoor

A China‑aligned threat actor, SlippyNunchucks, hijacked DNS requests in the Sogou Input Method to deploy the DarkVigil backdoor, targeting Chinese‑speaking users across Asia and Europe. The attack began July 1, 2026, exploiting insecure HTTP traffic to serve malicious configurations that download additional payloads via SGTool.exe. ESET identified the operation as a distinct intrusion set, noting its use of a modular .NET framework and DMTP for command‑and‑control. Tencent patched the vulnerability (CVE‑2026‑120422) on October 29, 2026, switching to HTTPS.

💡 The incident demonstrates how nation‑state actors can weaponize widely used language tools to conduct covert surveillance, bypassing traditional security measures. It underscores the need for secure communication protocols in everyday applications.

thehackernews.com · Nov 3

Barracuda Flaws Could Be Chained to Bypass Authorization and Gain Root Access

Barracuda disclosed two critical vulnerabilities that, when combined, enable attackers to bypass authorization and gain root access on affected devices. The pre‑authentication bypass (CVE‑2026‑116606, CVSS 9.3) targets the Email Security Gateway, while the command injection flaw (CVE‑2026‑111560, CVSS 8.6) affects several Barracuda products. Exploitation requires access to the administrative interface, and the attack chain can elevate privileges to root. Barracuda urges customers to patch promptly and avoid exposing admin interfaces to the internet.

💡 The chained flaws expose a rare privilege‑escalation route that could compromise entire security infrastructures, underscoring the urgency of timely patching and secure configuration.

thehackernews.com · Nov 3

Binance Reveals How Fake Job Interviews and AI Tool Abuse Led to…

Binance disclosed that a $6.43 billion theft from its platform resulted from a coordinated, multi‑stage attack that began with a trojanized Homebrew installer used by a Wallet DevOps engineer in June 2026. The malware installed a malicious AI tool, exposing internal credentials. In September, attackers posed as a recruiter on a job‑hunting site, conducted fake interviews with a second engineer, and delivered a poisoned code repository that compromised his workstation. By October, the threat actors leveraged the compromised machines and an internal AI tool to hijack a container deployment token, gain control of additional engineers, and access the wallet‑signing service, enabling unauthorized transactions. Binance has since rebuilt the affected wallet system, hardened device and AI controls, and expanded AI‑driven anomaly detection.

💡 The breach shows how social‑engineering via fake recruitment can infiltrate even highly secured crypto exchanges, turning internal developer tools into a conduit for massive fund loss.

thehackernews.com · Nov 3

mSecure Warns Users to Change Passwords, Reset 2FA and Passkeys After Suspicious…

mSecure, a password‑manager developed by mSeven Software, sent an email on Nov. 3 urging all current and former users to change passwords, reset two‑factor authentication and delete stored passkeys after the company detected “suspicious activity” linked to the app. The notice provides no details about the nature of the activity, when it occurred, which systems were affected, or whether any vault data was compromised. mSeven said it has launched an investigation, taken containment steps and hired external cybersecurity experts, but has not posted any comment on its X or Facebook accounts and staff have not responded in the support forum where a customer shared the email. The app encrypts vault data on the device before syncing to cloud services, per prior analysis.

💡 The vague alert forces millions of password‑manager users to scramble for security measures, exposing how limited transparency can erode trust in tools meant to protect digital identities.