Ubuntu.com Offline 4 Hours in Second 2026 DDoS as Launchpad and Snap Store Remain Uptime

Canonical faced a second distributed denial-of-service attack in 2026, disrupting public-facing websites for more than four hours. The company confirmed the incident on October 8, noting that while primary web properties were affected, core developer services remained intact.

What happened

Canonical announced on October 8 that its websites were under a sustained distributed denial-of-service attack. The company posted the alert on the Ubuntu Discourse forum, stating that some services might be intermittently unreachable. According to SecurityWeek, the disruption targeted primary web properties including ubuntu.com and canonical.com.

The outage also impacted the Ubuntu blog, the developer portal, and security advisory pages. Security Affairs reported that assets like academy.canonical.com and enterprise sites such as jaas.ai were among those affected. Users could not access security advisories or read blog posts during the peak of the attack.

Despite the widespread public disruption, critical backend services avoided downtime. Launchpad and the Snap Store remained online throughout the incident, allowing developers to manage software. Software repositories and mirror servers also stayed available, ensuring users could install updates.

OMG! Ubuntu calculated the total downtime at slightly more than four hours. Canonical stated on October 9 that its team was still restoring full functionality to affected services. The company did not disclose the size or geographic origin of this specific cyberattack.

Why it matters

This event marks the second significant DDoS attack on Canonical’s infrastructure this year. A larger incident occurred in late April, which took down Launchpad and the Snap Store. That earlier attack was described as a sustained, cross-border operation by the vendor.

The April disruption prevented some users from installing Ubuntu updates. A hacktivist group called The Islamic Cyber Resistance in Iraq – 313 Team claimed responsibility for that event. It remains unclear whether the October attack is connected to the April incident.

No group has claimed credit for the October 8 disruption. The company has not publicly shared details on the attack’s volume or source. The fact that developer-facing tools remained online suggests a targeted approach toward public-facing web assets.

The incident highlights the ongoing risk to public web infrastructure. Even with robust backend services, front-end availability can be compromised. Organizations relying on public web portals for information may face temporary access issues.

What to watch

• Monitor Canonical’s status page for updates on service restoration.
• Check if security advisory APIs are fully functional before patching.
• Verify that software repositories are accessible for update installations.
• Watch for any claims of responsibility from hacktivist groups.

What to do and how to stay safe: Canonical

• Pinpoint critical web dependencies and map out alternative access routes for essential information.
• Establish offline copies of security advisories to ensure access during public site outages.
• Configure automated update checks to retry connections rather than failing immediately.
• Monitor network traffic for unusual spikes that could indicate a coordinated attack.

Step-by-step guide: Social Engineering: How Manipulation Bypasses Technical Defenses

General security guidance from the Firewall Chronicle newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which Canonical services were affected by the October DDoS attack?

Public websites including ubuntu.com, canonical.com, the Ubuntu blog, and security advisory pages were disrupted. Launchpad and the Snap Store remained online.

Did anyone claim responsibility for the second DDoS attack?

No cybercrime or hacktivist group has publicly claimed responsibility for the October 8 attack. The April attack was claimed by a group called The Islamic Cyber Resistance in Iraq.

How long did the second DDoS attack last?

OMG! Ubuntu reported that the total downtime for affected services was a little over four hours. Canonical was still restoring services as of October 9.