Since today (7.9.) the bulls-eye security updates do not work properly anymore.
For example https://security.debian.org/debian-security/dists/bullseye-security/main/binary-amd64/Packages.gz
contains for "Package: systemd-sysv" the "Version: 247.3-7+deb11u8"
with "Filename:
pool/updates/main/s/systemd/systemd-sysv_247.3-7+deb11u8_amd64.deb",
but that directory only contains version
"systemd-sysv_252.38-1~deb12u1_amd64.deb".

On https://archive.debian.org/debian-security/dists/ there is also
neither "bullseye-security", nor "bullseye", and also
https://archive.debian.org/debian-security/pool/updates/main/s/systemd/
only has versions up to 241.7.

Yesterday, the update from security.debian.org still worked.

PS: I know Bullseye LTS support ended 31.8., but it would be nice if
either security.debian.org or archive.debian.org would still provide
the released updates, or at least not deliver broken metadata,
claiming a deb file that is no longer present. I'm maintainer of the
setup-wsl GitHub action which currently still has support for Bullseye
and currently fails to do an "apt-get update && apt-get upgrade --yes"
due to that.

Adding a data point that corroborates this report (package downloads via apt, not just Release/Packages metadata).

Since today (2026-09-07), `apt-get install` on Debian 11 (bullseye) fails  with 404 errors for several bullseye-security packages when fetched via  deb.debian.org

404 http://deb.debian.org/debian-security/pool/updates/main/v/vim/vim_8.2.2434-3+deb11u3_amd64.deb
404 http://deb.debian.org/debian-security/pool/updates/main/g/gnupg2/gnupg_2.2.27-2+deb11u3_all.deb
404 http://deb.debian.org/debian-security/pool/updates/main/g/glibc/libc-dev-bin_2.31-13+deb11u14_amd64.deb