Canonical, the company behind Ubuntu Linux, suffered a sustained distributed denial-of-service attack on October 8, 2026, disrupting its main websites and security information services. The outage lasted four hours and 12 minutes, according to OMG! Ubuntu. It was Canonical’s second major DDoS incident this year, following a broader disruption in late April.
Canonical confirmed the incident through Ubuntu Discourse, warning that some services could become intermittently unavailable. “Canonical’s websites are under a sustained distributed denial of service attack,” the company stated. Its engineers worked to restore access, and an October 9 update said most affected services were available again while recovery work continued.
Ubuntu Websites and Security APIs Affected
The affected services included ubuntu.com, canonical.com, the Ubuntu blog, the developer portal, and Ubuntu’s security advisory pages and API. These resources provide product information, developer guidance, and vulnerability details. Their disruption left users unable to reliably reach parts of Ubuntu’s public web infrastructure, even though several software delivery services continued operating.
The security API outage was particularly relevant to administrators and automated tools that retrieve vulnerability records and security notices. When those endpoints are unavailable, checks may fail or receive information later than expected. However, the reported interruption does not establish that security records were changed, software packages were compromised, or attackers accessed customer systems.
Launchpad, the Snap Store, Ubuntu Single Sign-On, personal package archives, and the CD image server remained operational during the October incident, according to OMG! Ubuntu’s report. Package repositories were also unaffected. This limited the disruption, allowing software downloads and package operations to continue despite problems reaching the main websites and security pages.
Canonical has not publicly disclosed the attack’s traffic volume, technical method, or origin. No group appeared to have claimed responsibility in reporting published on October 12. Although the outage affected prominent services, there is no published bandwidth figure supporting a measured description of its scale. The confirmed impact was a sustained loss of availability.
The earlier incident reached more services, including Launchpad and the Snap Store. Cybersecurity News covered that event in its report on the Ubuntu website and Canonical DDoS attack.
For Ubuntu users, the incident highlights the need to distinguish website outages from package delivery failures. Administrators should track Canonical’s official status page before assuming every Ubuntu service is affected.
Cybersecurity News’ guide to DDoS protection services provides related reading on defenses against traffic floods that can interrupt public websites and APIs without proving a breach.
Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup into your SOC
