---
title: "Security digest: November 4, 2026"
url: https://erroneo.us/security/2026-11-04/
description: "November 4, 2026 vulnerability digest: 3 briefs (APT CVE-2026-109518: Package Swap to Root on…); 1 CISA KEV addition (Apple). What to patch and who can relax."
type: security-digest-day
section: "Security Digest"
date_published: 2026-11-04
date_modified: 2026-11-05
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: November 4, 2026

3 editorial briefs and 1 known exploited (cisa kev) addition.

## Take stock

- Patch this week: APT CVE-2026-109518: Package Swap to Root on Debian/Ubuntu . Anyone running Debian 12 or later, Ubuntu 22.04 LTS or later, or a derivative, especially CI runners, Docker builds and fleets that fetch packages over plain http:// or through shared mirrors and caching proxies.
- Check exposure: Rails Active Storage: Upload-to-File-Write via ImageMagick . Rails apps that accept uploads from untrusted users and use config.active_storage.variant_processor = :mini_magick (the default under load_defaults 6.1 or earlier) on hosts whose ImageMagick policy does not block MSL and Ghostscript coders, including stock Debian and Ubuntu.
- Check exposure: Poisoned Source . Organizations with iPhones or iPads on iOS 16 or 17 builds before the May 2024 fixes, or below current iOS 18 patches, or Android devices running Chrome 139 to 145, and site owners whose pages loaded the Plerdy tracker between August 27 and September 3, 2026.
- Do you run any of these? Apple Multiple Products. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-11-18.
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Editorial briefs

- **Patch this week** [APT CVE-2026-109518: Package Swap to Root on Debian/Ubuntu](https://erroneo.us/security/briefs/apt-hardlink-retry-package-swap-cve-2026-109518/index.md): Nobody is known to be exploiting it and the attacker must sit between you and your mirror, but APT is the trust root for every Debian and Ubuntu machine and image you build, so update apt itself this week and rebuild base images.
- **Check exposure** [Rails Active Storage: Upload-to-File-Write via ImageMagick](https://erroneo.us/security/briefs/rails-active-storage-imagemagick-file-write-ghsa-f3w6/index.md): Only apps that run Active Storage through ImageMagick (:mini_magick) and accept untrusted uploads are exposed, but for them an unauthenticated upload can write files and, with the Disk service, read secret_key_base, so those apps should upgrade today.
- **Check exposure** [APT29 Hijacks Plerdy Script to Hit Unpatched Phones](https://erroneo.us/security/briefs/apt29-poisoned-source-plerdy-cve-2024-27834-kev/index.md): Every chain in this campaign uses already-patched bugs and Sekoia says fully updated devices are safe, so the real work is finding the stale iPhones and Android phones in your fleet and checking whether your sites loaded Plerdy in late August.

## Known exploited (CISA KEV)

- [CVE-2024-27834](https://erroneo.us/security/cve/CVE-2024-27834/index.md) Apple Multiple Products: Apple Multiple Products Improper Authentication Vulnerability (CISA due 2026-11-18)

## Critical advisories

None.

---
Source page: https://erroneo.us/security/2026-11-04/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt