Key points
- The outage lasted four hours and 12 minutes, affecting domains such as ubuntu.com and canonical.com.
- Critical infrastructure including package repositories, installation images, and PPAs remained operational throughout the incident.
- This event followed a more extensive cross-border attack in May, though technical details of the October disruption remain unspecified.
Canonical announced that its public-facing websites and security information services were inaccessible due to a sustained distributed denial-of-service attack. According to GBHackers, the disruption lasted for four hours and 12 minutes before access was fully restored. The incident impacted several key domains, including ubuntu.com, canonical.com, blog.ubuntu.com, and developer.ubuntu.com.
In plain English
The attack prevented users from reaching Ubuntu’s main website and its security notice pages. However, the core software delivery systems remained unaffected. As reported by OMG!, Ubuntu repositories, installation images, and Personal Package Archives continued to function normally. This means that while users could not view security updates online, they could still download software packages and system images.
The background
Canonical had warned visitors that some online sites would be intermittently unavailable during the peak of the attack. The company’s teams worked to restore access but did not initially provide an estimated recovery time. This October incident is distinct from a larger attack in May, which Canonical described as a sustained cross-border attack. The May event affected a wider range of services, including Launchpad PPAs, the Snap Store, and Ubuntu Single Sign-On.
What changes now
The October disruption did not replicate the broader service outage seen in May. Ubuntu PPAs, the CD image server, Launchpad, the Snap Store, and Ubuntu Single Sign-On were reported as operational during this latest incident. While Canonical conducted a post-incident review after the May attack to strengthen infrastructure, it is unclear whether specific defensive changes limited the impact of the October event. No technical details about the attack volume or methods were released.
Background: DDoS attacks
Distributed denial-of-service attacks overwhelm targets with traffic from many sources. You must understand the three main types: volumetric floods, protocol exploits, and application layer requests. Each type requires different detection methods. Blocking one type often leaves your service vulnerable to another.
Read the full guide: DDoS Attacks Types: How Floods of Traffic Break Services
What to do and how to stay safe: Ubuntu
- Monitor your own public-facing web services for unusual traffic spikes or latency increases that may indicate a reflection or amplification attack.
- Ensure that critical software updates and security patches are cached locally or mirrored, so teams can access them even if upstream vendor websites are unreachable.
- Verify that your incident response plans include procedures for operating when external security advisory feeds, such as the Ubuntu Security API, are temporarily offline.
- Check that your DNS and web application firewalls are configured to absorb volumetric traffic surges without blocking legitimate user access to essential services.
Step-by-step guide: Phishing vs Spam: How to Tell the Difference and Stop Threats
General security guidance from the RedTeam Log newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Did the DDoS attack affect Ubuntu software downloads?
No, Ubuntu repositories, installation images, and Personal Package Archives remained unaffected during the disruption, according to OMG!.
Which specific websites were taken offline by the attack?
The attack impacted canonical.com, ubuntu.com, blog.ubuntu.com, developer.ubuntu.com, and the Ubuntu Security API and notices pages.
Was this attack similar to the one in May?
No, the October incident had a narrower impact and did not affect services like Launchpad PPAs or the Snap Store, which were disrupted in May.
