SecurityNot yet confirmed elsewhere1 publisher2 min readPublished
Second DDoS this year disrupts Canonical's ubuntu.com and Ubuntu security advisory API
Canonical confirmed an October 8 DDoS attack on its websites, including ubuntu.com and the Ubuntu security advisory pages and API. OMG! Ubuntu put the downtime at a little over four hours in the second DDoS to hit Canonical this year.
The Watch · Security desk
OMG! Ubuntu says ubuntu.com, canonical.com, the blog, developer site and security advisory pages and API were disrupted. Launchpad and the Snap Store did not appear affected; a late-April attack took them down. Canonical has not shared the attack's size or origin.
- exposure ubuntu.com and canonical.com Among the primary web properties OMG! Ubuntu says were disrupted, with the Ubuntu blog and developer site, claim 4
- exposure Ubuntu security advisory API OMG! Ubuntu lists the security advisory pages and API among the disrupted web properties, claim 4
- capability Launchpad and the Snap Store Developer-facing services that did not appear to be affected, SecurityWeek reported, claim 5
- precedent Launchpad, Snap Store in April Taken down in a more disruptive late-April attack that left some users unable to install Ubuntu updates, claim 9
- decision Canonical Has not publicly shared the size or origin of the attack; no one appears to have taken credit, claim 8
| Who | How | Kind | Claim |
|---|---|---|---|
| ubuntu.com and canonical.com | Among the primary web properties OMG! Ubuntu says were disrupted, with the Ubuntu blog and developer site | exposure | 4 |
| Ubuntu security advisory API | OMG! Ubuntu lists the security advisory pages and API among the disrupted web properties | exposure | 4 |
| Launchpad and the Snap Store | Developer-facing services that did not appear to be affected, SecurityWeek reported | capability | 5 |
| Launchpad, Snap Store in April | Taken down in a more disruptive late-April attack that left some users unable to install Ubuntu updates | precedent | 9 |
| Canonical | Has not publicly shared the size or origin of the attack; no one appears to have taken credit | decision | 8 |
What happened
- Launchpad and the Snap Store, Canonical's developer-facing services, did not appear to be affected.
- On October 9 Canonical said its team was still bringing affected services back, though most were accessible again.
- Canonical has not publicly shared the size or origin of the attack, and no one appears to have taken credit for it.
- The late-April attack was more disruptive: it took down Launchpad and the Snap Store and left some users unable to install Ubuntu updates.
Why it matters
- exposure Scanners, patch dashboards and compliance jobs that call Ubuntu's advisory API live depend on endpoints that were on the disrupted list.
- decision Teams that poll that API have to choose between holding a local copy of the advisory data and accepting gaps in fix-status lookups the next time it is unreachable.
- precedent Two attacks about five months apart give operators a rate to plan around, though no source links the two incidents.
Canonical's own statement was short. In a post on the Ubuntu Discourse forum, the company said, "Canonical's websites are under a sustained distributed denial of service attack," and added that some services might not be reachable at times [2][3].
The list of what was hit comes from OMG! Ubuntu, as relayed by SecurityWeek: ubuntu.com, canonical.com, the Ubuntu blog and developer site, and the security advisory pages and API [4]. The four-hour downtime figure is also OMG! Ubuntu's [7]. Both are single-sourced to that outlet.
April is the comparison. Canonical described that incident as a "sustained, cross-border attack" [9]. A hacktivist group calling itself The Islamic Cyber Resistance in Iraq - 313 Team claimed it [10]. SecurityWeek says it is unclear whether the two incidents are connected [12]. Nothing in the reporting ties the October attack to that claim.
For operators the exposure is narrow. A person reading an advisory page can retry later. A scanner, patch dashboard or compliance report that calls the advisory API live has nothing to work from while the endpoint is down, unless a copy exists locally. The advisory API was on the disrupted list [4].
The two attacks fall about five months apart [13]. In our view that is enough reason for any team that polls the advisory API to keep its own copy of the data.
What to watch
- Whether Canonical publishes the size, origin or a post-incident account of the October 8 attack.
- Whether any group claims the October attack, and whether that claim connects it to the 313 Team's April claim.
- Any further outage of the security advisory pages or API, which would make three disruptions in a year.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence45
- Adoption
- Insufficient
- Hype gap0
- Incentives
- Insufficient
- Confidence55
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Canonical confirmed the DDoS attack on October 8 in a post on the Ubuntu Discourse forum.
ReportedSupportedSource: Canonical, via Ubuntu Discourse post, as reported by SecurityWeekView cited source - [2]
"Canonical's websites are under a sustained distributed denial of service attack," the company said.
ReportedSupportedSource: Canonical, Ubuntu Discourse post, as quoted by SecurityWeekView cited source - [3]
Canonical said some services might not be reachable at times.
ReportedSupportedSource: Canonical, Ubuntu Discourse post, as reported by SecurityWeekView cited source - [4]
According to OMG! Ubuntu, the disruption was limited to Canonical's primary web properties: ubuntu.com, canonical.com, the Ubuntu blog and developer site, and Ubuntu's security advisory pages and API.
- [5]
Developer-facing services such as Launchpad and the Snap Store did not appear to be affected.
- [6]
On October 9 Canonical said its team was still bringing affected services back, though most were accessible again.
- [7]
OMG! Ubuntu put the total downtime at a little over four hours.
- [8]
Canonical has not publicly shared information on the size or origin of the cyberattack, and no one appears to have taken credit for it.
- [9]
Canonical was hit by a more disruptive attack in late April that took down Launchpad and the Snap Store, among other services, and left some users unable to install Ubuntu updates; the company described it as a "sustained, cross-border attack."
- [10]
A hacktivist group calling itself The Islamic Cyber Resistance in Iraq - 313 Team claimed responsibility for the April attack.
- [11]
The October attack is the second DDoS attack to disrupt Canonical this year.
- [12]
It is unclear whether the April and October incidents are connected.
- [13]
The April and October attacks fall about five months apart.
Sources
1 independent publisher whose own reporting we read for this story.
- securityweek.comCanonical Websites Disrupted in Second DDoS Attack This Year
1 article · October 12, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- DDoS Attacks and MitigationFollow
- Open-source infrastructure securityFollow