Good morning. A flaw in APT lets someone in the network path slip a fake package onto Debian and Ubuntu machines, and the fixed APT is already out. Rails fixed a critical upload bug for apps that use ImageMagick, Xen patched two bugs that let one VM reach every other VM on the host, and an old Apple bug is back in use against phones that stopped updating.
Lead Story
APT on Debian and Ubuntu can be tricked into installing a swapped package that runs as root. Fixed builds shipped November 4. Update APT safely →
Also Worth Your Attention
A crafted upload can write files on Rails apps that process images with ImageMagick. Rails 8.0 security support ends Saturday. Check your image processor →
Don’t Miss the Policy Changes That Affect Security Decisions
Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Two Xen bugs let a malicious VM read and write the memory of every other VM on the host, with no workaround. Plan the reboots →
CISA listed a 2024 Apple bug as exploited, and Sekoia found it in a campaign against iPhones and Android phones that missed updates. Find the old phones →
Also on the radar: Canonical fixed CVE-2026-112816, a CVSS 10.0 flaw that lets an attacker with a trusted client’s public certificate log in to LXD or MicroCloud’s network API; run snap refresh lxd and confirm 6.10.1, 5.21.9, 5.0.11 or 4.0.15 (Canonical advisory, The Hacker News). SonicWall says it will not patch two flaws, CVE-2026-109593 and CVE-2026-109594, in its end-of-life GMS management software, so keep GMS off the internet and plan the move to NSM (BleepingComputer).
Too many patches for one week? Our patch priority checklist sorts them by exposure and exploitation.
Source: Debian DSA-6607-1; Rails advisory; Xen XSA-523; Sekoia report
Slack paste: APT: install the November 4 fix with -o Acquire::Retries=0 and move sources to HTTPS; Rails: upgrade to 8.1.4.1 or 8.0.5.2 and confirm the ImageMagick policy loads; Xen: apply XSA-523 and reboot hosts; phones: list devices below current iOS or Chrome 146 and cut off the ones that cannot update.
Go Deeper
- Cybersecurity tools for patch tracking and fleet checks
- Identity and access management: signing out stolen sessions
Get this in your inbox every weekday morning: subscribe to the Daily Brief.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
