CANONICAL suffered its second DDoS intrusion of 2026, disrupting public-facing websites for just over four hours. The company disclosed on 8 October via Ubuntu Discourse that canonical[.]com, ubuntu[.]com, the Ubuntu blog, the developer portal, and security advisory pages and APIs were affected, with some services intermittently unavailable. Launchpad and the Snap Store remained online throughout the incident, limiting broader disruption to developers and users attempting to access advisories and blog posts.
Canonical’s status page confirmed the outage and noted that the Ubuntu Security API and Livepatch services were temporarily impacted, although software repositories and mirrors stayed available so packages could still be downloaded and installed.
Evidence from the piece indicates this was not claimed by a cybercrime or hacktivist group at the time of reporting. The attack is described as a sustained DDoS that compromised the main portals and services, in contrast with an earlier April incident that took down Launchpad and the Snap Store and was linked to a hacktivist group calling itself the Islamic Cyber Resistance in Iraq (313 Team). It remains unclear whether the October event is a continuation of the same campaign or a separate actor’s activity.
Canonical’s distributed infrastructure helped contain the damage, but the incident nonetheless caused noticeable disruption to users seeking security advisories and other canonical content.