Verified, then swapped: two supply-chain attacks on the code you didn't write

On 4 November 2026, two unrelated reports landed on the same day. In the morning, Debian, Ubuntu and the developers of APT, the program that installs software on both systems, published fixes for a fl