Canonical Confirms Second DDoS Attack Disrupted Ubuntu and Corporate Websites

Canonical confirmed on October 8 that its websites were under a sustained distributed denial-of-service attack, disrupting access to key Ubuntu and corporate properties. The company announced the incident in a post on the Ubuntu Discourse forum, stating that some services might not be reachable at times due to the ongoing assault on its infrastructure.

The disruption was limited to Canonical’s primary web properties, according to OMG! Ubuntu. Affected sites included ubuntu.com, canonical.com, the Ubuntu blog, the developer site, and Ubuntu’s security advisory pages and API. Developer-facing services such as Launchpad and the Snap Store did not appear to be affected by this specific attack, allowing core development workflows to continue uninterrupted.

Context of the Outage

Canonical stated on October 9 that its team was still working to bring affected services back online, though most were accessible again by that time. OMG! Ubuntu reported that the total downtime lasted a little over four hours. The company has not publicly shared information regarding the size or origin of this cyberattack, and no threat actor has claimed responsibility for the disruption so far.

Background on Previous Incidents

This event marks the second DDoS attack on Canonical this year, following a more disruptive incident in late April. That earlier attack took down Launchpad and the Snap Store, preventing some users from installing Ubuntu updates. Canonical described the April incident as a “sustained, cross-border attack,” and a hacktivist group called The Islamic Cyber Resistance in Iraq – 313 Team claimed responsibility for it.

It remains unclear whether the October attack and the April incident are connected. The April attack was significantly more severe, impacting core developer tools, whereas the October event was confined to informational and advisory web properties. SecurityWeek reported these details regarding the timeline and scope of both events.

What should you do?

Security professionals should monitor the status of Ubuntu security advisory pages, as access was temporarily disrupted. Organizations relying on Canonical services should verify the operational status of Launchpad and the Snap Store, which remained unaffected in this instance. IT teams should review their own DDoS mitigation strategies and ensure redundancy for critical documentation and update sources.

What to do and how to stay safe: Canonical

• Verify the operational status of critical developer platforms like Launchpad and the Snap Store to ensure development pipelines remain functional.
• Monitor official Ubuntu Discourse forums and security advisory pages for updates on service availability and confirmed fixes.
• Review network logs for unusual traffic patterns that could indicate a distributed denial-of-service attempt targeting your infrastructure.
• Ensure that local caches of security advisories and update packages are maintained to reduce dependency on real-time web access during outages.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which Canonical services were affected by the October DDoS attack?

The attack disrupted ubuntu.com, canonical.com, the Ubuntu blog, the developer site, and Ubuntu’s security advisory pages and API.

Were Launchpad and the Snap Store affected by this attack?

No, developer-facing services such as Launchpad and the Snap Store did not appear to be affected by this specific incident.

Did any group claim responsibility for the October attack?

No, no one appears to have taken credit for the DDoS attack, unlike the April incident which was claimed by a hacktivist group.