Pierluigi Paganini
October 12, 2026
Ubuntu’s parent company Canonical spent part of last week fighting off a sustained distributed denial of service (DDoS) attack, the second one to hit its infrastructure this year. The company revealed the attack on October 8 through a post on the Ubuntu Discourse forum.
“Canonical’s websites are under a sustained distributed denial of service attack. Our team is working diligently to resolve the incident. Please refer to our status page for up-to-date information. Some services may be intermittently unavailable.” the company states.
At this time, no cybercrime or hacktivist group has claimed responsibility
The attack affected Canonical’s main public websites, including ubuntu.com, canonical.com, the Ubuntu blog, the developer portal, and the security advisory pages and API. Users may have been unable to access security advisories or read the blog during the attack.
“It was recently revealed that Canonical’s web infrastructure and the Ubuntu ecosystem suffered a massive and sustained distributed denial-of-service (DDoS) attack that caused its main portals and services to crash and be intermittent for more than four hours.” states the company blog. “Regarding the attack, it is mentioned that it directly affected the most visible institutional domains, including canonical.com and ubuntu.com, as well as the official blog, the developer portal, assets.ubuntu.com, academy.canonical.com and sites linked to enterprise technologies such as jaas.ai and maas.io.”
However, Launchpad and the Snap Store remained online throughout the incident. These services allow developers and system administrators to manage and install software.
Canonical acknowledged the outage on its status page and Ubuntu Discourse while engineers worked to limit the impact. The attack temporarily disrupted the Ubuntu Security API and Livepatch services, affecting tools used to check security advisories and apply kernel patches without restarting systems. However, Canonical’s distributed infrastructure helped contain the damage. Software repositories and mirror servers remained available, allowing users to install updates. Launchpad, the Snap Store, disk image servers and Ubuntu Single Sign-On also continued to work.
As a result, users could continue downloading and installing packages even while Canonical’s public websites were disrupted.
The overall outage lasted a little over four hours, causing real disruption.
This attack differs from the April one, which caused greater disruption by taking down Launchpad and the Snap Store and preventing some users from installing Ubuntu updates. At the time, a hacktivist group called The Islamic Cyber Resistance in Iraq, also known as 313 Team, claimed responsibility.
Canonical described the April incident as a sustained, cross-border attack, language that suggested distributed infrastructure spanning multiple countries. Whether this October attack is a continuation of the same campaign or a completely unrelated actor piling on is genuinely unclear.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, DDoS)
