DreamHost Confirms Months-Long Breach Exposing Customer Files and Email Inboxes
DreamHost has disclosed a data breach in which attackers maintained unauthorized access to its systems for several months before detection. According to a notice filed with the California Attorney General, the intrusion began in August 2026 and was only discovered and disclosed last Thursday, following a multi-day outage during which DreamHost reset some customer passwords. The attackers exploited an unspecified vulnerability in DreamHost's file manager feature, used by customers to store files, to steal session tokens that allowed them to hijack authenticated user sessions without needing passwords. DreamHost stated the compromise is unrelated to recently disclosed PHP vulnerabilities. The company declined to detail the exploited flaw or explain the detection delay, citing an ongoing investigation, but said affected customers represent "well under 10%" of its roughly 400,000 paying customers.
Entenda a falha
A vulnerabilidade
An unspecified vulnerability in the DreamHost file manager, the feature customers use to store files, was exploited by attackers. DreamHost has not named the flaw, its type, the affected versions or a fix, and no CVE exists. The articles do not say what an attacker needs, such as authentication or user interaction. The result was theft of session tokens, which let attackers act as the legitimate user. Reported exposure includes customer emails, credentials, inboxes and files.
Como funciona
The articles do not describe the technical flow of the flaw. What is known is that the attackers abused the file manager to obtain session tokens, which keep a user logged in after the password is entered. With a stolen token, the attacker is treated by the system as that authenticated user, with no password needed. The step at which the file manager fails is not disclosed.
Por que é vulnerável
The root cause has not been disclosed. DreamHost declined to detail the flaw or explain why the intrusion went undetected for months, citing an ongoing investigation. The only stated link is that the weakness let session tokens be stolen. The company says the incident is unrelated to the recently disclosed PHP vulnerabilities.
Como foi descoberta
The articles do not say who found the flaw or how. DreamHost disclosed the breach last Thursday, after a multi-day outage during which it reset some customer passwords, in a notice filed with the California Attorney General. According to that notice, the intrusion began in August, so attackers were inside for months before detection. The company declined to explain the detection delay. It says affected customers are well under 10% of its roughly 400,000 paying customers.
Explicação gerada por IA a partir da matéria e dos artigos, em 04/11/2026 18:16.
Detalhes técnicos
Attackers exploited a vulnerability in DreamHost's file manager to steal session tokens, which keep users authenticated after login. Possession of these tokens allows an attacker to impersonate the legitimate user and access their account without credentials. Stolen data reportedly includes customer emails and credentials, as well as access to customer inboxes and files.
Remediação
DreamHost reset passwords for some affected customers following the outage. The company has not disclosed the specific vulnerability or provided guidance beyond the password resets at the time of reporting.
Linha do tempo
-
DreamHost Confirms Months-Long Breach Exposing Customer Files and Email Inboxes
ler a análise desta fonte ocultar
DreamHost has disclosed a data breach in which attackers maintained unauthorized access to its systems for several months before detection. According to a notice filed with the California Attorney General, the intrusion began in August 2026 and was only discovered and disclosed last Thursday, following a multi-day outage during which DreamHost reset some customer passwords. The attackers exploited an unspecified vulnerability in DreamHost's file manager feature, used by customers to store files, to steal session tokens that allowed them to hijack authenticated user sessions without needing passwords. DreamHost stated the compromise is unrelated to recently disclosed PHP vulnerabilities. The company declined to detail the exploited flaw or explain the detection delay, citing an ongoing investigation, but said affected customers represent "well under 10%" of its roughly 400,000 paying customers.
Technical Details
Attackers exploited a vulnerability in DreamHost's file manager to steal session tokens, which keep users authenticated after login. Possession of these tokens allows an attacker to impersonate the legitimate user and access their account without credentials. Stolen data reportedly includes customer emails and credentials, as well as access to customer inboxes and files.
Remediation
DreamHost reset passwords for some affected customers following the outage. The company has not disclosed the specific vulnerability or provided guidance beyond the password resets at the time of reporting.