Ubuntu and Canonical web services hit by DDoS attack

Canonical has confirmed that its web infrastructure was hit by a sustained, cross-border Distributed Denial-of-Service attack after multiple Ubuntu and Canonical services went down.

The outage affected public Ubuntu websites, Canonical portals, package-related infrastructure, and security advisory services used by developers and system administrators.

A hacktivist group calling itself The Islamic Cyber Resistance in Iraq, also known as 313 Team, claimed responsibility for the attack. Canonical has confirmed the DDoS attack, but it has not publicly confirmed the group’s claim.

Ubuntu services faced widespread disruption

The disruption affected services that many Ubuntu users rely on for downloads, updates, documentation, account access, and security data. Reports during the incident showed failures across Ubuntu and Canonical domains.

Affected services included ubuntu.com, canonical.com, archive.ubuntu.com, security.ubuntu.com, developer.ubuntu.com, blog.ubuntu.com, assets.ubuntu.com, portal.canonical.com, maas.io, jaas.ai, and academy.canonical.com.

Ubuntu Security API endpoints for CVEs and notices were also listed as affected during the outage. That made the incident more serious for security teams that depend on Ubuntu vulnerability feeds for automated patching and advisory tracking.

At a glance

Category	Details
Company affected	Canonical
Main project affected	Ubuntu
Incident type	Distributed Denial-of-Service attack
Attack description	Sustained, cross-border DDoS attack
Services affected	Ubuntu websites, Canonical websites, security APIs, archive services, and developer portals
Claimed by	The Islamic Cyber Resistance in Iraq, 313 Team
Confirmed attribution	Canonical confirmed the DDoS attack, but not the attacker claim

Why the security API outage matters

Ubuntu’s security data matters because many administrators use it to track vulnerabilities, fixes, and security notices for Ubuntu packages.

Canonical maintains Ubuntu CVE records and publishes Ubuntu Security Notices when security issues are fixed in official Ubuntu packages. These feeds help teams understand which systems need attention.

If CVE and notice endpoints become unavailable, automated workflows may lose a key source of Ubuntu-specific vulnerability information. That can slow patch decisions, compliance checks, and security reporting.

Package downloads and updates were also affected

The outage also affected services linked to package access and downloads. archive.ubuntu.com and security.ubuntu.com are important because Ubuntu systems use them to fetch packages and security updates.

Some users reported failed or slow update attempts during the disruption. TechCrunch also reported that it verified failed updates on a test Ubuntu device during the incident.

Canonical’s web infrastructure is under a sustained, cross-border attack and we are working to address it.

We will provide more information in our official channels as soon as we are able to.

— Ubuntu (@ubuntu) May 1, 2026

Users may still be able to use regional mirrors when the main archive is disrupted, but that depends on mirror availability and local configuration.

Key services mentioned during the incident

Service	Why it matters
ubuntu.com	Main public Ubuntu website for downloads, product information, and documentation paths.
canonical.com	Canonical’s main company website.
archive.ubuntu.com	Core package archive used by Ubuntu systems.
security.ubuntu.com	Security update source for Ubuntu systems.
Ubuntu Security API, CVEs	API source for Ubuntu CVE data.
Ubuntu Security API, Notices	API source for Ubuntu Security Notice data.
portal.canonical.com	Canonical customer and account-related portal.
maas.io	Canonical’s Metal as a Service project website.
jaas.ai	Canonical’s Juju as a Service site.

Hacktivist group claims responsibility

The 313 Team claimed responsibility for the disruption through its channels, according to multiple reports. The group framed the attack as a hacktivist operation.

The Register reported that the group also sent a message to Canonical that appeared to move the incident toward extortion, saying Canonical had been given a Session contact ID.

The group’s exact motivation remains unclear. Ubuntu is one of the most widely used Linux distributions, which makes its web infrastructure a high-visibility target.

A DDoS attack does not mean a breach

A DDoS attack aims to overwhelm services with traffic so legitimate users cannot access them. It does not automatically mean attackers stole data or compromised internal systems.

However, the operational impact can still be serious. Developers may lose access to downloads, users may face update failures, and security teams may need temporary alternatives for advisory feeds.

For open-source infrastructure, availability matters because many organizations build automation around public package repositories, documentation pages, vulnerability data, and release channels.

What Ubuntu users and admins should do

• Check Canonical’s official status page before troubleshooting local systems.
• Try a trusted Ubuntu mirror if archive.ubuntu.com is unavailable.
• Do not disable security controls to force package downloads from unknown sources.
• Use official Ubuntu and Canonical channels for updates on the incident.
• For vulnerability tracking, use temporary backup sources such as NVD or OSV where appropriate.
• Retry package updates after service recovery if apt commands fail or hang.
• Document failed update windows for internal compliance and patch reporting.

Why this attack stands out

The attack stands out because it hit services used by a large open-source ecosystem, not just a single company website.

Ubuntu runs across desktops, servers, cloud environments, containers, developer workstations, and enterprise infrastructure. Any extended outage can create friction for a wide range of users.

The incident also shows how DDoS attacks can pressure open-source projects by targeting availability instead of code integrity. Even without a data breach, downtime can disrupt security workflows and routine maintenance.

FAQ