Debian and Ubuntu have patched CVE-2026-109518, a package manager flaw that lets on-path attackers substitute code and get root.