Canonical (8 Oct): sustained DDoS takes ubuntu.com, canonical.com, the Ubuntu blog, developer portal and the Ubuntu Security API/CVE pages offline for about four hours; Launchpad, Snap Store and package mirrors unaffected; second attack this year
Canonical posted on Ubuntu Discourse at 15:09 UTC on 8 October 2026 (23:09 Perth) that its websites were under a sustained distributed denial-of-service attack, that some services might be intermittently unavailable, and that its team was working on it. A follow-up on 9 October said most affected services were back. The disruption hit Canonical's main web properties: ubuntu.com, canonical.com, blog.ubuntu.com, developer.ubuntu.com and the Ubuntu Security API and CVE notice pages. OMG! Ubuntu put the outage at 4 hours 12 minutes. Developer-facing services (Launchpad and PPAs, the Snap Store, the CD image server and Ubuntu SSO) were reported as operational, and APT package mirrors are distributed separately. Canonical has not said how large the attack was, where it came from, or who was behind it, and no group appears to have claimed it. It is the second DDoS against Canonical this year. The late-April/May 2026 'sustained, cross-border attack' took down Launchpad and the Snap Store and stopped some users installing updates; a hacktivist group calling itself The Islamic Cyber Resistance in Iraq – 313 Team claimed that one. For defenders, the practical effect was that Ubuntu security notices and CVE status pages were briefly unreachable. Primary: Canonical on Ubuntu Discourse (8–9 Oct); wire: SecurityWeek (12 Oct).
- Product
- Canonical / Ubuntu public web properties (ubuntu.com, canonical.com, blog, developer portal, Ubuntu Security API and CVE pages)
- Versions
- n/a — availability incident, not a product CVE
- Exploited in Australia?
- unknown
- Patch to
- No customer action needed for installed systems. Patch pipelines: don't depend on ubuntu.com security pages being up. Mirror USN/OVAL data locally, or pull from Launchpad and the package mirrors, so vulnerability scanning and patch approval keep running during a web outage.
Primary: Ubuntu Discourse (Canonical) — DDoS on Canonical and Ubuntu websites (8 Oct 2026, update 9 Oct) · Vendor: Canonical status page · SecurityWeek — Canonical websites disrupted in second DDoS attack this year (12 Oct 2026)