Loading story…
Ubuntu package repository access was disrupted after regional archive mirrors for the US and Canada failed to resolve correctly, leaving administrators unable to reliably reach package infrastructure. Reports indicated that ca.archive.ubuntu.com returned a CNAME to us.archive.ubuntu.com, while us.archive.ubuntu.com had no DNS record, pointing to a DNS or service availability failure rather than a routine mirror outage.
Canonical's status page also showed problems affecting security.ubuntu.com, expanding the impact beyond regional mirrors to Ubuntu's security update channel. The incident raised immediate operational risk for organizations that depend on Ubuntu repositories for package installation, patching, and automated update workflows, although no confirmed root cause was publicly provided in the referenced reports.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
A Reddit post reported that the US and Canada Ubuntu regional archive mirrors were not resolving properly, with ca.archive.ubuntu.com pointing to us.archive.ubuntu.com and us.archive.ubuntu.com returning no DNS record. The same post said Canonical's status page indicated security.ubuntu.com was also down, suggesting a broader repository availability or DNS issue.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Canonical confirmed widespread disruption across Ubuntu and Canonical web infrastructure after a sustained distributed denial-of-service attack hit `ubuntu.com` and related services. The pro-Iran hacktivist group **The Islamic Cyber Resistance in Iraq (313 Team)** claimed responsibility on Telegram, describing the operation as a multi-hour campaign, while reports said the impact lasted more than 12 hours. Canonical acknowledged the outages on its status page and through Ubuntu social channels as teams worked to restore availability. The incident affected core services including website access, Canonical account logins, developer portals, package and security endpoints such as `archive.ubuntu.com`, `security.ubuntu.com`, and Ubuntu Security API resources for CVEs and notices. The disruption interfered with Ubuntu downloads, package installation, system updates, vulnerability-data retrieval, and automated patching workflows used by administrators worldwide. A follow-up message from the group introduced an apparent extortion angle, warning Canonical to make contact or face continued attacks, although no motive for targeting the company was publicly stated.
Jun 29, 2026
Ubuntu published multiple security notices to fix **Linux kernel vulnerabilities** affecting a broad range of releases, including Ubuntu `14.04 LTS`, `16.04 LTS`, `18.04 LTS`, `20.04 LTS`, `22.04 LTS`, `24.04 LTS`, and `25.10`. The Canadian Centre for Cyber Security highlighted the advisories in notices `AV26-264` and `AV26-296`, covering Ubuntu security updates released over consecutive weekly periods. The Cyber Centre urged users and administrators to review the referenced Ubuntu Security Notices and apply the required updates to affected systems. The advisories describe defensive patching activity for kernel flaws across supported Ubuntu versions and do not report a named threat actor, ransomware operation, or confirmed active exploitation campaign.
Jul 2, 2026
Ubuntu published security notices addressing **Linux kernel vulnerabilities** affecting multiple supported releases, and the Canadian Centre for Cyber Security highlighted the advisories in alert `AV26-686`. The notices apply to **Ubuntu 18.04 LTS, 22.04 LTS, 24.04 LTS, 25.10, and 26.04 LTS**, indicating that several generations of desktop and server deployments require attention. The Cyber Centre urged administrators and users to review the linked **Ubuntu Security Notices** and install the required updates to remediate the flaws. The advisory points organizations to Ubuntu's official security notice portal for release-specific patches and mitigation details, underscoring the need to prioritize kernel updates across affected systems.
Jul 13, 2026