[SECURITY] [DSA 6607-1] apt security update

Debian published security advisory DSA-6607-1 on November 4, 2026, patching a flaw in the APT package manager tracked as CVE-2026-109518 and discovered by Max Justicz. The vulnerability lets APT merge two different package downloads when an HTTP redirect assigns them the same URI, and improper file handling during resumed HTTP downloads allows a man-in-the-middle attacker to swap a package after verification, achieving arbitrary code execution as root. The update also fixes several out-of-bounds access issues. The stable "trixie" distribution is patched in apt version 3.0.4, and maintainer Salvatore Bonaccorso urged users to upgrade their apt packages. The flaw matters because APT underpins package installation across Debian and its derivatives, so a root-level compromise vector affects a broad install base. Watch for uptake of the 3.0.4 build and for backports to older Debian releases and downstream distributions that inherit APT.