FRESH

Hacker News

Home

Canonical/Ubuntu have been under DDoS

208 points by jtlebigot

by piker

6 subcomments

Though this outage may be more related to the copy.fail upgrade cycle, it reminds me of a thought I've had recently in respect of agents.
In the UK they have this issue called "TV pickup" (https://en.wikipedia.org/wiki/TV_pickup). TV pickup is where everyone in the UK watching a popular TV show gets up to boil a high-powered tea kettle at the same time on an ad break. This causes a temporary surge in electricity demand and leads to real outages. It was a mystery at first but now is accounted for.
I suspect the global internet is facing an "agent pickup" problem where significant changes (e.g., releases of new frontier models or new package versions) puts unpredictable pressure on arbitrary infrastructure as millions of distributed agents act to address the change simultaneously.

by mayhemducks

2 subcomments

Maybe they could use this DDoS attack as their 17th round technical interview. Any candidate who successfully mitigates the attack would then make it to the 18th round. Win win!

by TonyTrapp

1 subcomments

While the timing with the copy.fail patches mentioned by a few comments here seems suspicious indeed, I have seen this repeating over the last few weeks: packages.ubuntu.com was hardly reachable on some days, causing apt-get to take forever to update the system. They have been struggling hard recently, it seems. Best of luck to the people having to deal with this mess on a holiday!

by Faaak

6 subcomments

Tinfoil hat mode: a competitor wants to exploit copy.fail on some ubuntu servers, and is DDoSing canonical so that they can't update and thus patch the vuln

by corvad

0 subcomment

This seems to be pretty targeted, and with the services affected like livepatch and such this could indeed be an actor DDoSing to avoid patches rolling out for copy.fail

by dang

0 subcomment

Related ongoing thread:
Pro-Iran crew turns DDoS into shakedown as Ubuntu.com stays down - https://news.ycombinator.com/item?id=47975729 - May 2026 (59 comments)

by Wxc2jjJmST9XWWL

1 subcomments

Noticed it because snap didn't work, snap has its own status page just fyi: https://status.snapcraft.io/

by SilentM68

0 subcomment

Could this DDoS be affecting some components of https://ppa.launchpadcontent.net? I know they're supposed to be down and up again, but I still get errors when I update Ubuntu :(

by lproven

0 subcomment

Also here: https://news.ycombinator.com/item?id=47989372

by sidewndr46

0 subcomment

It's almost certainly related to preventing the roll out of copy.fail fixes. Someone held the capability in reserve until they had a good reason to use it.

by jollymonATX

0 subcomment

We are so broken as society ddos'n ubuntu is now a thing.

by Bender

1 subcomments

Anyone from Canonical shared any pcaps of the attack yet? Or perhaps a summary of packet types, sizes, payloads, TCP/IP header characteristics? State table statistics?

by securicat

0 subcomment

Explains why I needed to torrent Ubuntu 26.04 today. Even navigating to the alternative/mirror page to grab the torrent file was painful.

by someperson

0 subcomment

I like to imagine it's returning a 500 error response asking you to email rhonda@ubuntu.com

0 subcomment

by drillsteps5

0 subcomment

Another wave today (5/2/2026), launchpadcontent.net is down...

by bastardoperator

0 subcomment

No mitigation can stop Aisuru. Let's hope it's not that because the only end in sight is them getting bored and moving on to the next victim.

by ddactic

0 subcomment

[flagged]

0 subcomment