The Debian and Ubuntu APT package manager contains a flaw that lets an attacker who can modify package downloads swap a checked package for their own. According to advisories published on November 4 by Debian, Ubuntu, and APT's developers, the attacker's code then runs as root.
The attack requires APT to retry failed downloads. The report says APT does this by default from Debian 12 and the text is cut off there, so the affected versions cannot be confirmed from the supplied material.