Canonical Faces Second DDoS Attack in 2026

Canonical confirmed its websites were hit by a sustained distributed denial of service attack on October 8. These attacks overwhelm sites with traffic to block access during an incident. This marks the second time the company has faced such an assault in the year 2026. The announcement appeared on the Ubuntu Discourse forum while engineers worked to resolve the issue.

The disruption affected primary web properties including ubuntu.com and canonical.com. Users could not access the Ubuntu blog, developer portal, or security advisory pages during the outage. The attack also temporarily impacted the Ubuntu Security API and Livepatch services used for kernel patches.

Despite the outage, Launchpad and the Snap Store remained online throughout the incident. These platforms allow developers to manage software and install updates without interruption. Software repositories and mirror servers also stayed available for users to download packages.

Reports indicate the total downtime lasted a little over four hours. The company acknowledged the outage on its status page while limiting the impact. Most affected services became accessible again by October 9.

This incident differs from a larger attack Canonical suffered in late April. That previous event took down Launchpad and the Snap Store, preventing some users from installing updates. The company described the earlier incident as a sustained cross-border attack at the time.

No cybercrime or hacktivist group has claimed responsibility for this October attack. In contrast, a group called The Islamic Cyber Resistance in Iraq claimed the April assault. It is unclear whether these two incidents are connected to the same actors.

Canonical has not publicly shared information on the size or origin of this cyberattack. The company noted that some users may have been unable to read the blog or check security advisories during the disruption. It stated that its distributed infrastructure helped contain the damage.

Whether this October attack is a continuation of the same campaign or a completely unrelated actor piling on is genuinely unclear. Both reports agree that while services returned, the event caused real disruption for public websites.