APT package-manager flaw lets a man-in-the-middle run code as root on Debian and Ubuntu

The Hacker News reported that a flaw in APT, the package manager for Debian and Ubuntu, lets an attacker who can modify package downloads swap a checked package for their own, after which the attacker's code runs as root. The Hacker News says the attack needs APT to retry a failed download, and that Debian, Ubuntu and APT's developers published advisories on 4 November. If you run Debian or Ubuntu, match your estate against those vendor advisories and apply the fixes they name.

BleepingComputer reported that Zyxel patched a zero-day in its GS1900 series network switches that attackers exploited to compromise nearly 1,000 devices worldwide and steal configuration files and credentials. The Hacker News separately reported that SonicWall warned of two vulnerabilities in end-of-life Global Management System 9.5.2 and earlier — including an unauthenticated file read — that it said it will not patch.

On breaches: BleepingComputer reported that DreamHost confirmed attackers accessed its File Manager platform for two months and stole customers' FTP/SFTP usernames and passwords and webmail sessions. The Record reported that Japan Airlines, Cathay Pacific, Korean Air, Asiana Airlines, Singapore Airlines and Malaysia Airlines reported data breaches traced to Amadeus IT Group. The Record also reported that Crédit Mutuel Arkéa confirmed a cyber heist in which attackers made transfers using the bank's own account after compromising an unnamed supplier, with an estimated $133 million stolen. BleepingComputer reported that France's national blood service confirmed a cyberattack on a refrigeration equipment provider raised temperature and defrost settings at three facilities, threatening stored blood products.

BleepingComputer reported a supply-chain attack on the Goddess of Victory: NIKKE PC launcher, whose tampered scripts distributed malware that steals credentials and cryptocurrency wallet data. The Record reported a suspected Russian cyberattack that disrupted the website of The Kyiv Independent, and a separate case in which a Canadian was extradited to the US over alleged cryptomining intrusions at schools in at least four states, dating to 2016.

On defences: BleepingComputer reported that Vercel is rolling out Device Bound Session Credentials to blunt stolen-cookie attacks, and The Register reported that Apple will begin scanning public iCloud share links for "harmful content," a term it has not defined.