Canonical confirmed a sustained DDoS attack disrupted public web properties for over four hours, though developer tools remained online.
Key points
- Canonical’s public websites were disrupted by a sustained distributed denial-of-service attack.
- Developer-facing services like Launchpad and the Snap Store remained operational throughout.
- This marks the second such attack on Canonical infrastructure this year.
Canonical confirmed that its public websites were disrupted by a sustained distributed denial-of-service attack. The incident lasted for more than four hours, affecting primary web properties while leaving critical developer services online.
What happened
Canonical announced the attack on October 8 via a post on the Ubuntu Discourse forum. The company stated that its websites were under sustained assault and that some services might be intermittently unreachable. According to SecurityWeek, the disruption was limited to Canonical’s primary web properties.
Affected domains included ubuntu.com, canonical.com, the Ubuntu blog, and the developer portal. The Ubuntu Security API and advisory pages were also impacted. Security Affairs reported that assets.ubuntu.com, academy.canonical.com, and enterprise sites like jaas.ai and maas.io were directly affected by the outage.
Despite the broad impact on public-facing sites, developer-facing infrastructure remained stable. Launchpad and the Snap Store did not appear to be affected by the attack. Disk image servers and Ubuntu Single Sign-On continued to function normally.
By October 9, Canonical engineers were restoring affected services, with most becoming accessible again. OMG! Ubuntu estimated the total downtime at slightly over four hours. The company has not disclosed the size or origin of this specific cyberattack.
Why it matters
This incident represents the second DDoS attack on Canonical infrastructure this year. A larger, more disruptive attack occurred in late April, which took down Launchpad and the Snap Store. That earlier incident was described as a sustained, cross-border attack.
The Islamic Cyber Resistance in Iraq – 313 Team claimed responsibility for the April attack. No group has claimed credit for the October incident. It remains unclear whether the two events are connected.
The October attack temporarily disrupted the Ubuntu Security API and Livepatch services. These tools help users check security advisories and apply kernel patches without restarting systems. However, software repositories and mirror servers remained available, allowing users to install updates.
The fix
- Monitor the official status page for real-time updates on service availability.
- Check the Ubuntu Discourse forum for official announcements regarding incident resolution.
- Verify connectivity to critical developer tools like Launchpad independently of public sites.
What to do and how to stay safe: Canonical
- Cache critical security advisories locally if you rely on the Ubuntu Security API for automated checks.
- Ensure your systems can reach software repositories directly, bypassing the main ubuntu.com portal if possible.
- Watch for intermittent connectivity issues when accessing the Ubuntu blog or developer portal.
- Confirm that Livepatch services are functioning correctly if you depend on them for kernel updates.
Step-by-step guide: Social Engineering Risks and Protection for Small Businesses
General security guidance from the Crypt Weekly newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Did the DDoS attack affect Launchpad or the Snap Store?
No, Launchpad and the Snap Store remained online and operational throughout the incident.
How long did the disruption last?
OMG! Ubuntu reported that the total downtime was a little over four hours.
Who is responsible for this attack?
No cybercrime or hacktivist group has claimed responsibility for this specific attack.
