ITsecurity Daily
Daily Briefing
APT package-manager flaw lets a man-in-the-middle run code as root on Debian and Ubuntu
Good morning. The Hacker News reported that a flaw in APT, the package manager for Debian and Ubuntu, lets an attacker who can modify package downloads swap a checked package for their own, after which the attacker's code runs as root. The Hacker News says the attack needs APT to retry a failed download, and that Debian, Ubuntu and APT's developers published advisories on 4 November. If you run Debian or Ubuntu, match your estate against those vendor advisories and apply the fixes they name.
BleepingComputer reported that Zyxel patched a zero-day in its GS1900 series network switches that attackers exploited to compromise nearly 1,000 devices worldwide and steal configuration files and credentials. The Hacker News separately reported that SonicWall warned of two vulnerabilities in end-of-life Global Management System 9.5.2 and earlier — including an unauthenticated file read — that it said it will not patch.
On breaches: BleepingComputer reported that DreamHost confirmed attackers accessed its File Manager platform for two months and stole customers' FTP/SFTP usernames and passwords and webmail sessions. The Record reported that Japan Airlines, Cathay Pacific, Korean Air, Asiana Airlines, Singapore Airlines and Malaysia Airlines reported data breaches traced to Amadeus IT Group. The Record also reported that Crédit Mutuel Arkéa confirmed a cyber heist in which attackers made transfers using the bank's own account after compromising an unnamed supplier, with an estimated $133 million stolen. BleepingComputer reported that France's national blood service confirmed a cyberattack on a refrigeration equipment provider raised temperature and defrost settings at three facilities, threatening stored blood products.
Zoom out: The Record and BleepingComputer report that several of the day's incidents — the Crédit Mutuel Arkéa heist, the French blood-storage disruption and the airline breaches — reached their victims through a compromised third-party supplier.
Vulnerability in focus
CVE-2026-118527 — Ivanti. CVSS 4.3 CISA lists it as known to be exploited.
Affected: ivanti-cs.
What to do: Follow the vendor advisory for the fixed release and any interim mitigation.
Elsewhere
- The Hacker News: Hackers Exploit Patched Apple Flaw to Deliver Info-Stealing Malware, CISA Says Read it
- The Hacker News: OpenAI AI Pipeline Generates 948 Linux Root Escalation Exploits in 30-Hour Run Read it
- Krebs on Security: Want to Rent an Internet Address at the White House? Read it
- The Register: Apple turns iCloud into spy cloud, will start looking at public share links Read it
- BleepingComputer: Zyxel fixes zero-day exploited to hack nearly 1,000 network switches Read it
- The Record: Canadian extradited to US for allegedly hacking schools in at least four states Read it
- The Record: French bank confirms cyber heist, hackers suspected to have stolen an estimated $133 million Read it
- BleepingComputer: Cyberattack disrupts blood storage refrigeration systems in France Read it
- The Hacker News: Researchers Uncover Prompt Adware Hidden in OpenAI Codex Jailbreak Toolkit Read it
- The Hacker News: SonicWall Won't Patch EoL GMS Flaws That Could Expose Files, Alter Database Records Read it
- The Hacker News: Debian and Ubuntu APT Flaw Lets MitM Attackers Swap Verified Packages and Run Code as Root Read it
- The Record: Ukrainian news outlet Kyiv Independent hit by suspected Russian cyberattack Read it
Sources
- Apple turns iCloud into spy cloud, will start looking at public share links The Register
- Vercel rolls out new protection against stolen session cookie attacks BleepingComputer
- More Asian airlines announce data breaches after attack on Spanish IT provider Amadeus The Record
- Debian and Ubuntu APT Flaw Lets MitM Attackers Swap Verified Packages and Run Code as Root The Hacker News
- Cycurion Habit verifies threats and validates fixes before closing cases Help Net Security
- Sysdig Adds Runtime Security and Governance for AI Agents SecurityWeek
- Zyxel fixes zero-day exploited to hack nearly 1,000 network switches BleepingComputer
- Canadian extradited to US for allegedly hacking schools in at least four states The Record
- DreamHost confirms data breach exposed FTP logins and webmail sessions BleepingComputer
- French bank confirms cyber heist, hackers suspected to have stolen an estimated $133 million The Record
- Cyberattack disrupts blood storage refrigeration systems in France BleepingComputer
- SonicWall Won't Patch EoL GMS Flaws That Could Expose Files, Alter Database Records The Hacker News
- NIKKE PC game launcher hacked to spread remote access, data-stealing malware BleepingComputer
- Ukrainian news outlet Kyiv Independent hit by suspected Russian cyberattack The Record
Share this issue
Facebook · X · Reddit · LinkedIn · WhatsApp · Email · Bluesky
Every briefing is on the site, with the advisory record behind it. All briefings