Second DDoS this year disrupts Canonical's ubuntu.com and Ubuntu security advisory API
Canonical confirmed an October 8 DDoS attack on its websites, including ubuntu.com and the Ubuntu security advisory pages and API. OMG! Ubuntu put the downtime at a little over four hours in the second DDoS to hit Canonical this year.
The Watch · Security desk
OMG! Ubuntu says ubuntu.com, canonical.com and the security advisory pages and API were down a little over four hours. Launchpad and the Snap Store did not appear affected. A late-April attack, claimed by the 313 Team, took them down and left some users unable to install updates.
- Who's exposed exposure Ubuntu security advisory API OMG! Ubuntu lists the security advisory pages and API among the disrupted web properties, claim 4
- What it costs cost Canonical's web properties OMG! Ubuntu put the total downtime at a little over four hours, claim 7
- What's now possible capability Launchpad and the Snap Store Developer-facing services that did not appear to be affected, SecurityWeek reported, claim 5
- What it sets up precedent Ubuntu users in April Late-April attack took down Launchpad and the Snap Store and left some users unable to install updates, claim 11
- What it sets up precedent 313 Team Hacktivist group that claimed responsibility for the April attack, claim 12
- Who has to decide decision Canonical Has not shared the size or origin of this attack; no one appears to have taken credit, claim 8
| Who | How | Kind | Claim |
|---|---|---|---|
| Ubuntu security advisory API | OMG! Ubuntu lists the security advisory pages and API among the disrupted web properties | exposure | 4 |
| Canonical's web properties | OMG! Ubuntu put the total downtime at a little over four hours | cost | 7 |
| Launchpad and the Snap Store | Developer-facing services that did not appear to be affected, SecurityWeek reported | capability | 5 |
| Ubuntu users in April | Late-April attack took down Launchpad and the Snap Store and left some users unable to install updates | precedent | 11 |
| 313 Team | Hacktivist group that claimed responsibility for the April attack | precedent | 12 |
| Canonical | Has not shared the size or origin of this attack; no one appears to have taken credit | decision | 8 |
What happened
- Launchpad and the Snap Store, Canonical's developer-facing services, did not appear to be affected.
- On October 9 Canonical said its team was still bringing affected services back, though most were accessible again.
- Canonical has not publicly shared the size or origin of the attack, and no one appears to have taken credit for it.
- The late-April attack was more disruptive: it took down Launchpad and the Snap Store and left some users unable to install Ubuntu updates.
Why it matters
- Who's exposed exposure Scanners, patch dashboards and compliance jobs that call Ubuntu's advisory API live depend on endpoints that were on the disrupted list.
- Who has to decide decision Teams that poll that API have to choose between holding a local copy of the advisory data and accepting gaps in fix-status lookups the next time it is unreachable.
- What it sets up precedent Two attacks about five months apart give operators a rate to plan around, though no source links the two incidents.
Next story · Build · yesterday
Ubuntu 26.10 ships a near-final Linux 7.3 and finishes the Rust coreutils switchConfirmed2 publishers
Canonical's own statement was short. In a post on the Ubuntu Discourse forum, the company said, "Canonical's websites are under a sustained distributed denial of service attack," and added that some services might not be reachable at times [2][3].
The list of what was hit comes from OMG! Ubuntu, as relayed by SecurityWeek: ubuntu.com, canonical.com, the Ubuntu blog and developer site, and the security advisory pages and API [4]. The four-hour downtime figure is also OMG! Ubuntu's [7]. Both are single-sourced to that outlet.
April is the comparison. Canonical described that incident as a "sustained, cross-border attack" [11]. A hacktivist group calling itself The Islamic Cyber Resistance in Iraq - 313 Team claimed it [12]. SecurityWeek says it is unclear whether the two incidents are connected [10]. Nothing in the reporting ties the October attack to that claim.
For operators the exposure is narrow. A person reading an advisory page can retry later. A scanner, patch dashboard or compliance report that calls the advisory API live has nothing to work from while the endpoint is down, unless a copy exists locally. The advisory API was on the disrupted list [4].
The two attacks fall about five months apart [13]. In our view that is enough reason for any team that polls the advisory API to keep its own copy of the data.
What to watch
- Whether Canonical publishes the size, origin or a post-incident account of the October 8 attack.
- Whether any group claims the October attack, and whether that claim connects it to the 313 Team's April claim.
- Any further outage of the security advisory pages or API, which would make three disruptions in a year.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence58
- Adoption
- Not scored
- Hype gap+8
- Incentives
- Not scored
- Confidence68
Perspective Coverage
3 publishers- Builder
- Builder 22%
- Operator
- Operator 71%
- Investor
- Investor 7%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Canonical confirmed the DDoS attack on October 8 in a post on the Ubuntu Discourse forum.
- [2]
"Canonical's websites are under a sustained distributed denial of service attack," the company said.
- [3]
Canonical said some services might not be reachable at times.
- [4]
According to OMG! Ubuntu, the disruption was limited to Canonical's primary web properties: ubuntu.com, canonical.com, the Ubuntu blog and developer site, and Ubuntu's security advisory pages and API.
- [5]
Developer-facing services such as Launchpad and the Snap Store did not appear to be affected.
- [6]
On October 9 Canonical said its team was still bringing affected services back, though most were accessible again.
- [7]
OMG! Ubuntu put the total downtime at a little over four hours.
- [8]
Canonical has not publicly shared information on the size or origin of the cyberattack, and no one appears to have taken credit for it.
- [9]
The October attack is the second DDoS attack to disrupt Canonical this year.
- [10]
It is unclear whether the April and October incidents are connected.
- [11]
Canonical was hit by a more disruptive attack in late April that took down Launchpad and the Snap Store, among other services, and left some users unable to install Ubuntu updates; the company described it as a "sustained, cross-border attack."
- [12]
A hacktivist group calling itself The Islamic Cyber Resistance in Iraq - 313 Team claimed responsibility for the April attack.
- [13]
The April and October attacks fall about five months apart.
Sources
3 independent publishers whose own reporting we read for this story.
- scworld.comCanonical faces second DDoS attack this year, disrupting public websites
1 article · October 13, 2026
- securityaffairs.comCanonical Hit by Second DDoS Attack in 2026, Public Websites Disrupted
1 article · October 12, 2026
- securityweek.comCanonical Websites Disrupted in Second DDoS Attack This Year
1 article · October 12, 2026
Topics and entities
Topics
- Linux distribution security
- DDoS Attacks and Mitigation