Verify Ubuntu repos and mirrors; Canonical public sites offline 4 hours in Oct DDoS

Canonical confirmed that its websites were disrupted by a sustained distributed denial-of-service attack on October 8, according to a post on the Ubuntu Discourse forum. The company stated that some services might not be reachable at times while its team worked to resolve the incident and mitigate the impact on public-facing infrastructure.

The attack primarily targeted Canonical’s main web properties, including ubuntu.com, canonical.com, the Ubuntu blog, and the developer portal, according to SecurityWeek. Users also experienced intermittent access to Ubuntu’s security advisory pages and API. The disruption lasted for a little over four hours, with most services becoming accessible again by October 9, as reported by OMG! Ubuntu.

Technical Scope and Impact

The outage affected the most visible institutional domains, including assets.ubuntu.com, academy.canonical.com, and enterprise technology sites such as jaas.ai and maas.io, according to the company blog. The attack temporarily disrupted the Ubuntu Security API and Livepatch services, which are used to check security advisories and apply kernel patches without restarting systems. Despite these interruptions, Canonical’s distributed infrastructure helped contain the damage to public-facing assets.

Developer Services Unaffected

Critical developer-facing services, including Launchpad and the Snap Store, remained online throughout the incident, according to Security Affairs. Disk image servers and Ubuntu Single Sign-On also continued to work without interruption. Software repositories and mirror servers remained available, allowing users to install updates and manage software even while the main portals were experiencing intermittent availability or downtime.

What to watch

Canonical has not publicly shared information on the size or origin of this cyberattack, nor has any group claimed responsibility, according to SecurityWeek. The company is still bringing affected services back to full stability, though most are already accessible. It remains unclear whether this incident is connected to the larger attack that hit Canonical’s infrastructure in late April, which was described as a sustained, cross-border attack.

Background: Security advisories

Security advisories provide the technical context needed to prioritize patches. They explain the severity, affected components, and mitigation steps. Without them, teams guess which fixes matter, leaving critical gaps open to exploitation while wasting time on low-risk updates.

Read the full guide: How Security Advisories Drive Patch Decisions and Reduce Risk

What to do and how to stay safe: Canonical

• Monitor the official Canonical status page for real-time updates on service availability and recovery progress.
• Verify the integrity of downloaded packages by checking signatures against trusted keys, especially if updates were applied during the outage.
• Use cached or local copies of security advisories if the Ubuntu Security API remains intermittently unavailable.
• Review firewall logs for unusual traffic patterns that might indicate residual effects or related probing attempts.

Step-by-step guide: Multi-Factor Authentication Setup for Small Teams

General security guidance from the Shell Bulletin newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Did the DDoS attack affect the Snap Store or Launchpad?

No, Launchpad and the Snap Store remained online throughout the incident, according to Security Affairs.

How long did the disruption last?

The total downtime was a little over four hours, with most services accessible again by October 9, according to OMG! Ubuntu.

Who claimed responsibility for this attack?

No cybercrime or hacktivist group has claimed responsibility for this specific attack, according to Security Affairs.