Canonical posted on Ubuntu Discourse at 15:09 UTC on 8 October 2026 (23:09 Perth) that its websites were under a sustained distributed denial-of-service attack, that some services might be intermittently unavailable, and that its team was working on it.

A follow-up at 11:40 UTC on 9 October said the team was still restoring affected services and most were now available, and on 14 October Canonical said all websites were restored.

The disruption hit Canonical's main web properties: ubuntu.com, canonical.com, blog.ubuntu.com, developer.ubuntu.com and the Ubuntu Security API and CVE notice pages. Developer-facing services (Launchpad and PPAs, the Snap Store, the CD image server and Ubuntu SSO) were reported as operational, and APT package mirrors are distributed separately.

Canonical has not said how large the attack was, where it came from, or who was behind it, and no group appears to have claimed it. It is the second DDoS against Canonical this year. The late-April/May 2026 'sustained, cross-border attack' took down Launchpad and the Snap Store and stopped some users installing updates; a hacktivist group calling itself The Islamic Cyber Resistance in Iraq – 313 Team claimed that one.

For defenders, the practical effect was that Ubuntu security notices and CVE status pages were briefly unreachable. Primary: Canonical on Ubuntu Discourse (8–9 Oct); wire: SecurityWeek (12 Oct).

Correction (23 Oct 2026): an earlier version said the sites were offline for about four hours, a figure from an outlet not linked here; Canonical's own posts say restoration was still under way on 9 October and all websites were restored on 14 October. (source: https://discourse.ubuntu.com/t/ddos-on-canonical-and-ubuntu-websites/89064)