Canonical Web Properties Disrupted by Second DDoS Attack in 2026

Canonical suffered a second distributed denial-of-service attack in 2026, disrupting public websites for over four hours. Core developer services such as Launchpad and the Snap Store remained operational during the incident.

What happened

Canonical confirmed the attack on 8 October via the Ubuntu Discourse forum, stating that websites were under sustained assault. The company noted that some services might not be reachable at times during the event.

According to OMG! Ubuntu, the disruption lasted a little over four hours. Affected properties included ubuntu.com, canonical.com, the Ubuntu blog, and the developer portal.

The attack also impacted Ubuntu’s security advisory pages and API. Users reported intermittent access to these resources while engineers worked to mitigate the traffic surge.

Launchpad and the Snap Store did not appear to be affected by the outage. These critical developer-facing services remained online throughout the incident.

Canonical stated on 9 October that teams were restoring affected services. Most properties became accessible again by that date, according to SecurityWeek.

The company has not disclosed the size or origin of this specific attack. No group has claimed responsibility for the disruption so far.

Why it matters

This incident follows a larger attack in late April that took down Launchpad and the Snap Store. That earlier event was described as a sustained, cross-border attack.

The April incident prevented some users from installing Ubuntu updates. The Islamic Cyber Resistance in Iraq – 313 Team claimed responsibility for that attack.

It remains unclear whether the two incidents are connected. Security Affairs reported that software repositories and mirror servers stayed available during the recent outage.

The Livepatch service was temporarily disrupted during the latest attack. This affects tools used to apply kernel patches without restarting systems.

Next steps

• Monitor the official status page for real-time service updates.
• Check alternative mirror servers if primary repositories are slow.
• Verify security advisories via cached copies if the API is down.
• Review logs for unusual traffic patterns on public-facing endpoints.

What to do and how to stay safe: Canonical

• Ensure your organisation uses redundant DNS providers to mitigate single points of failure.
• Configure rate limiting on public-facing APIs to absorb sudden traffic spikes.
• Maintain offline copies of critical security advisories for periods of outage.
• Verify that incident response plans include procedures for DDoS mitigation scenarios.

Step-by-step guide: How to Prevent Account Takeover: The Technical Controls That Actually Work

General security guidance from the Packet Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which Canonical services were affected by the recent DDoS attack?

Public websites including ubuntu.com, canonical.com, the blog, developer portal, and security advisory pages were disrupted.

Did the attack affect Launchpad or the Snap Store?

No, Launchpad and the Snap Store remained online and operational throughout the incident.

Has anyone claimed responsibility for this specific attack?

No cybercrime or hacktivist group has claimed responsibility for this second attack.