Xubuntu Download Page Hacked: Malicious File Distributed for Several Days
The Xubuntu team has released detailed information about the October incident during which the downloads page at https://xubuntu.org/download/ distributed a malicious file for several days instead of the usual torrent links. According to the report, an attacker gained access to the site by brute-forcing the password to a vulnerable WordPress component installed by Canonical for the project. After that, malicious code was embedded into the system, replacing the legitimate download links.
The first warning about the suspicious file arrived on 15 October. Canonical immediately blocked the site, disabled the downloads page, and launched an investigation. From 15 to 19 October, specialists analyzed access logs, identified the intrusion path, removed all injected components, restored the affected pages, and strengthened WordPress security.
By 19 October, community members confirmed that the malicious archive had been removed and that the page was once again safe. On 11 November, Canonical provided the team with a final summary: the vulnerability had been closed, the server reinforced with additional protections, and access to the downloads section restored in read-only mode in preparation for migration to a new platform.
The incident affected only the web page and the substituted torrent files. The cdimages.ubuntu.com servers and the official Ubuntu repositories remained entirely secure, and mirrors were protected as long as they synchronized from official sources. Xubuntu’s build system, packages, and installation images were never compromised, and existing installations of the distribution were not at risk.
Users who downloaded or opened the file Xubuntu-Safe-Download.zip during the attack window are advised to delete it and scan their systems with antivirus software. The team stresses that this is a standard precautionary measure for incidents of this nature.
The breach accelerated Xubuntu’s transition to a Hugo-based static site, which eliminates entire classes of attacks that rely on WordPress vulnerabilities. The migration had been underway for some time, but the incident elevated it to a priority, and the new site is expected to launch soon.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
