Xubuntu confirms a malicious ZIP was served in October and is switching to the Hugo static site generator to prevent similar attacks.