cyber security

The #Debian APT security update fixes “Download verification bypass” CVE-2026-109518:

“On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified package and achieve remote code execution with root privileges. The vulnerability is caused by the reuse of hard links and requires the client to follow redirects and retry the download of package files. It requires the client to have a non-zero Acquire::Retries configuration setting; the value 3 is the default starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish), so older releases are unaffected in a default configuration”

cve.org/CVERecord?id=CVE-2026-109518

Obviously any Debian based distribution using APT can be affected as well and should install updates as soon as they become available.

The vulnerability description doesn’t mention this explicitly but if your system doesn’t have Emudhra certificates purged, they can be vulnerable even when using HTTPS sources.

Wer Sicherheitslücken findet und verantwortungsvoll meldet, macht uns alle sicherer und riskiert in Österreich trotzdem ein Strafverfahren. Der 77. Netzpolitischen Abend Österreich diskutierte im Wiener Parlament, wie Ethical Hacking rechtlich besser abgesichert werden kann.

Der netzpolitische Abend AT: Ethical Hacking
03.11. 20:00-20:57

o94.at/de/…

Eine neu entdeckte #Sicherheitslücke bedroht #Android Smartphones der Versionen 12 bis 17.

Eine unsichtbare, manipulierte #SMS kann Geräte in eine Neustartschleife versetzen. Im schlimmsten Fall droht #Datenverlust durch einen notwendigen Werksreset. Für Android 14 bis 17 stellt #Google Sicherheitsupdates bereit. Ältere Versionen erhalten voraussichtlich keine entsprechenden Korrekturen mehr.

swr3.de/aktuell/…

💼 Join the weekly Product Deep Dive for Business Admins on Oct. 28th to learn how to bring Bitwarden to work: bitwarden.com/events/…

🔐 The offline master keys were not offline. Zimmer, who ran the largest group of hijacked Tor relays, said so in his post-mortem. Copies sat in a backup on his management server, encrypted with a password the attacker already found. 😬

He was just as blunt about the cause: The root cause was ours: one password reused for SSH login, sudo, and the backup passphrase, stored in plaintext on both servers, plus SSH password authentication left enabled on the internet-facing management server. Credit to him for putting that in writing. 👏 I’d guess plenty of servers out there would earn the same sentence, maybe a few of yours.

In early October, attackers took over more than 300 Tor exit relays and rerouted SSH connections to 12 interception servers. At the peak on October 4, those relays carried 7.46% of Tor’s exit capacity, according to an analysis of public directory data. Zimmer’s own break-in came earlier. On August 28, the attacker logged into his management server with the account password on the first try and gained root within five minutes.

The victims got hit through passwords too. To get burned, you had to accept the interceptor’s host key and type a password. Some people saw an OpenSSH warning that the server had changed… others just got the usual prompt to accept a new key. If you used key-based login, the attacker couldn’t pass it through to the real server because the signature is tied to that session.

The backdoor is Ebury version 1.8.3, a single library file that leaves the packaged library alone, so the normal package checks come back clean. Zimmer’s servers showed none of the host-level signs on the Tor Projects checklist. The only thing that gave it away was the changed exit policy.

🚨 If you run anything with SSH open to the internet, turn off password login and use keys. If you accepted an unfamiliar or changed host key over Tor between October 1 and 5, assume that password is stolen, change it, and check the server. And if you’re poking around a box you suspect, log in with a key, since Ebury captures typed passwords.

Nobody knows yet how the other 58 operators got hit. On FranTech, the network behind BuyVM, 71 of 101 relays switched to the attackers’ policy, compared with 13 of 9,054 hosted elsewhere. The researcher who spotted this asked whether the attackers got in at the hosting provider level, and so far nobody has answered.

thehackernews.com/2026/…