Man-in-the-middle arbitrary code execution in Debian’s apt
0 comments · linux, security
- Comments8
–Rank now
#6Peak rank
3Days on list
278Score · 7d
Nov 4, 2026First seen
Rank · 7 days
On Lobsters
linuxsecurity
- Score
- 49
- Comments
- 8
- Submitted by
- gnyeki
- Tags
- linux, security
- Site
- lists.debian.org
Story details from Lobsters ↗ · linked article on lists.debian.org.
Trending history
Man-in-the-middle arbitrary code execution in Debian’s apt was first seen on Lobsters · Hottest on Nov 4, 2026. Since then it has appeared in 95 checks on 3 different days. Its best position was #6 of 25, reached on Nov 4, 20:51 UTC. It dropped off the list after Nov 6, 12:51 UTC. The same link also trended on Hacker News, which raises its cross-platform score.
Rank history
Position on Lobsters · Hottest at every check (lower is better).
Last 14 days
Best rank per day (UTC).
6
6
19
Oct 26today
Metric history
Platform metric as reported by Lobsters.
Where it trended
| List | Best | Days | Checks | Last seen |
|---|---|---|---|---|
| Lobsters · Hottest | #6 | 3 | 95 | |
| YHacker News · Front page Debian apt security update: man-in-the-middle arbitrary code execution | same link | |||
From the discussion
A few top-level comments from Lobsters, shortened. Read the full thread on Lobsters.
It's quite ironic that we'll use the vulnerable version of apt to update apt. To make sure that the package you're installing is authentic, you can use `apt download` to download packages, and compare their hashes against the package hashes found in the `Release` file for the given architecture.
Indeed, last time APT had an RCE the [advisory](https://lists.debian.org/debian-security-announce/2019/msg00010.html) contained the expected checksums of the fixed packages.
> It's quite ironic that we'll use the vulnerable version of apt to update apt. It's a very common problem of updater design that if you discover a bug, you have to patch this bug using the bugged updaters in the field. I've written a lot of updaters and thought a lot about this problem, but you can never make it…
Featured in
Archived daily, weekly and monthly lists that include this entry.
Questions
Is Man-in-the-middle arbitrary code execution in Debian’s apt trending on Lobsters right now?
Not at the moment. It was last on the list on Nov 6, 12:51 UTC, after 3 days of trending.
What is the highest rank Man-in-the-middle arbitrary code execution in Debian’s apt reached?
#6 on Lobsters · Hottest, on Nov 4, 20:51 UTC. Trendoday checks this list every 30 minutes.
How long has Man-in-the-middle arbitrary code execution in Debian’s apt been trending?
It was first seen on Nov 4, 2026 and has been on the list on 3 days (95 checks) since.