Regarding apt security update (DSA 6607-1 , CVE-2026-109518)

[markus7220]

https://lists.debian.org/debian-security-announce/2026/msg00526.html
https://lists.debian.org/deity/2026/11/msg00005.html

In short, this APT exploit allows an attacker to replace a package after verification, resulting in arbitrary code execution as root.

Besides updating apt to version 3.0.4+ (apt --version), an effective protection mechanism is to provide software repositories via HTTPS connection.
If not already done so, you should immediately upgrade apt before triggering any Proxmox updates from the unencrypted HTTP repository:

sudo apt-get update && sudo apt-get install --only-upgrade -o Acquire::Retries=0 apt

Non-subscribing Proxmox users are highly affected by this vulnerability, since HTTP connection of non-enterprise Proxmox package repository allows a Man-In-The-Middle attack, tampering with transferred package and replacing it by arbitrary package as superuser.

Kindly asking: In order to prevent similar future vulnerabilities and enhance base security for all Proxmox users, would it be possible to also switch to secure HTTPS connection for non-enterprise repo?

Kind regards

 

[LnxBil]

I feel you, but this is a great point for using the enterprise repository, which does not suffer from the problem.

Non-subscribing Proxmox users are highly affected by this vulnerability, since HTTP connection of non-enterprise Proxmox package repository allows a Man-In-The-Middle attack, tampering with transferred package and replacing it by arbitrary package as superuser.

You could still just use HTTPS, it's available and "only" the certificate is not valid for the domain. You could create a host alias on your end, or ignore the certificate AND still check it so that you don't run into a MITM.

In order to prevent similar future vulnerabilities and enhance base security for all Proxmox users, would it be possible to also switch to secure HTTPS connection for non-enterprise repo?

Not all Proxmox users, just the ones that don't subscribe, which is a very small number compared to paying customers. Although I am also a homelabber, I can understand Proxmox and I would do the same.