From Dev.to
Trust expires between the check and the use
The package that gets verified and then swapped On November 4, CVE-2026-109518 was published in APT, the package manager for Debian and Ubuntu. The flaw is a race. An attacker in the middle of the c...