Patch this week:APT CVE-2026-109518: Package Swap to Root on Debian/Ubuntu. Anyone running Debian 12 or later, Ubuntu 22.04 LTS or later, or a derivative, especially CI runners, Docker builds and fleets that fetch packages over plain http:// or through shared mirrors and caching proxies.
Check exposure:Rails Active Storage: Upload-to-File-Write via ImageMagick. Rails apps that accept uploads from untrusted users and use config.active_storage.variant_processor = :mini_magick (the default under load_defaults 6.1 or earlier) on hosts whose ImageMagick policy does not block MSL and Ghostscript coders, including stock Debian and Ubuntu.
Check exposure:Poisoned Source. Organizations with iPhones or iPads on iOS 16 or 17 builds before the May 2024 fixes, or below current iOS 18 patches, or Android devices running Chrome 139 to 145, and site owners whose pages loaded the Plerdy tracker between August 27 and September 3, 2026.
Do you run any of these? Apple Multiple Products. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-11-18.
None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.
Nobody is known to be exploiting it and the attacker must sit between you and your mirror, but APT is the trust root for every Debian and Ubuntu machine and image you build, so update apt itself this week and rebuild base images.
Must act: Anyone running Debian 12 or later, Ubuntu 22.04 LTS or later, or a derivative, especially CI runners, Docker builds and fleets that fetch packages over plain http:// or through shared mirrors and caching proxies.
Can relax: Systems on Debian 11 or Ubuntu 20.04 and older that never set Acquire::Retries, and hosts that only install packages from a local, trusted, HTTPS-served mirror, can schedule the update normally.
Update apt itself first: sudo apt-get update && sudo apt-get install --only-upgrade apt, then confirm the version with apt-cache policy apt.
Rebuild Docker base images and CI runner images so they ship the fixed apt; do not rely on the next routine rebuild.
Until a host is patched, install packages only from HTTPS sources or a mirror you control, and avoid untrusted networks and shared proxies.
Only apps that run Active Storage through ImageMagick (:mini_magick) and accept untrusted uploads are exposed, but for them an unauthenticated upload can write files and, with the Disk service, read secret_key_base, so those apps should upgrade today.
Must act: Rails apps that accept uploads from untrusted users and use config.active_storage.variant_processor = :mini_magick (the default under load_defaults 6.1 or earlier) on hosts whose ImageMagick policy does not block MSL and Ghostscript coders, including stock Debian and Ubuntu.
Can relax: Apps on the :vips processor (the default from load_defaults 7.0), apps that do not use Active Storage, and apps that only accept uploads from trusted staff should still take the release but need not rush.
Check your processor: bin/rails runner 'p Rails.application.config.active_storage.variant_processor'.
If it is :mini_magick and users can upload files, upgrade to Rails 8.1.4.1 or 8.0.5.2 and bundle update mini_magick to 5.1 or later.
If you cannot upgrade (or are on Rails 7.x or older), copy the shipped policy rules into /etc/ImageMagick-7/policy.xml (or ImageMagick-6) and at minimum deny the MSL coder, Ghostscript coders and the gs delegate.
Every chain in this campaign uses already-patched bugs and Sekoia says fully updated devices are safe, so the real work is finding the stale iPhones and Android phones in your fleet and checking whether your sites loaded Plerdy in late August.
Must act: Organizations with iPhones or iPads on iOS 16 or 17 builds before the May 2024 fixes, or below current iOS 18 patches, or Android devices running Chrome 139 to 145, and site owners whose pages loaded the Plerdy tracker between August 27 and September 3, 2026.
Can relax: People and fleets running current iOS, iPadOS, macOS and Chrome releases are not exposed to these chains, and sites that never embedded Plerdy have no supply-chain exposure from this incident.
Pull an OS-version report from your MDM and update or retire any iPhone or iPad not on a current iOS/iPadOS release.
Make sure Android devices run a current Chrome build (anything 139 to 145 is in scope) and current Android security patches.
If any of your sites loaded the Plerdy tracker, check whether it was active between August 27 and September 3, 2026, and tell your security team which audiences visited.