DreamHost Confirms Breach of File Manager, Theft of FTP/SFTP and Webmail Credentials
DreamHost has confirmed that a third party exploited a vulnerability in third-party software powering its browser-based File Manager tool, compromising the server operating files.dreamhost.com. The attacker accessed FTP/SFTP usernames and passwords for customers who used File Manager between approximately August 2026 and October 23, 2026, and also obtained credentials for a limited number of webmail accounts, with some mailbox contents potentially viewed. DreamHost discovered the unauthorized access on October 23, 2026, reset affected passwords, terminated active sessions, and estimates the breach affected well under 10% of hosted email and FTP/SFTP accounts. The company found no evidence that control panel logins or billing/payment card data were accessed, since it does not store full card numbers.
Entenda a falha
A vulnerabilidade
DreamHost says an attacker exploited an unnamed vulnerability in third-party software that powers its browser-based File Manager, and used it to compromise the server running files.dreamhost.com. No CVE, product name, version or flaw type has been disclosed, nor what access the attacker needed. The attacker obtained FTP/SFTP usernames and passwords of customers who used File Manager between about August 2026 and October 23, 2026, plus credentials for a limited number of webmail accounts, and may have viewed some mailbox contents. DreamHost says it patched the exploited flaw, but it gave no affected or fixed versions.
Como funciona
The articles do not describe the technical mechanism. They say only that the File Manager web interface, which customers use to manage website files, ran on third-party software, and that the flaw in it let an attacker compromise the server hosting it. Customers who logged into the tool before detection had their FTP/SFTP credentials exposed on that server. The attacker also reached certain webmail systems and took login credentials there. The step at which it goes wrong has not been published.
Por que é vulnerável
The root cause has not been disclosed; DreamHost refers only to a vulnerability in third-party software. The exposure window, from about August 2026 to October 23, suggests the compromise went unnoticed for some time before DreamHost detected it on October 23. The fix is described only as addressing the exploited vulnerability, with File Manager rebuilt and relaunched with added security controls and monitoring. DreamHost also rotated potentially exposed internal credentials and says its forensic investigation is ongoing. It states the incident is unrelated to recent PHP server updates.
Como foi descoberta
DreamHost discovered the unauthorized access on October 23, 2026, and on the same day reset affected passwords and terminated active sessions. It removed the affected servers, preserved the compromised server for forensics and engaged outside security and forensic specialists. Earlier reports had described forced password resets as precautionary; the later incident notice confirmed credential theft and attributed it to the third-party software flaw. The articles do not say who found the flaw or how the intrusion was detected. DreamHost is notifying regulators and affected customers.
Explicação gerada por IA a partir da matéria e dos artigos, em 05/11/2026 04:16.
Detalhes técnicos
The compromise stemmed from exploitation of a vulnerability in third-party software underlying the File Manager web interface. DreamHost removed the affected servers, patched the exploited flaw, preserved the compromised server for forensics, and rebuilt and relaunched File Manager with added security controls and monitoring. It also rotated potentially exposed internal credentials and is reviewing other customer-facing tools for similar weaknesses. The company clarified the incident is unrelated to recent PHP server updates and that its forensic investigation is ongoing.
Remediação
Affected customers should treat FTP/SFTP and webmail credentials used during the exposure window as compromised and change them via the account control panel (only the account holder can reset passwords; changes take up to 15 minutes). Users should update saved credentials in email and file-transfer clients, avoid password reuse, inspect website files for unauthorized modifications, review mailbox forwarding rules and filters, and remain alert to phishing—DreamHost stated its incident emails never request passwords or contain sign-in links.
Linha do tempo
-
DreamHost Confirms Breach of File Manager, Theft of FTP/SFTP and Webmail Credentials
ler a análise desta fonte ocultar
DreamHost has confirmed that a third party exploited a vulnerability in third-party software powering its browser-based File Manager tool, compromising the server operating files.dreamhost.com. The attacker accessed FTP/SFTP usernames and passwords for customers who used File Manager between approximately August 2026 and October 23, 2026, and also obtained credentials for a limited number of webmail accounts, with some mailbox contents potentially viewed. DreamHost discovered the unauthorized access on October 23, 2026, reset affected passwords, terminated active sessions, and estimates the breach affected well under 10% of hosted email and FTP/SFTP accounts. The company found no evidence that control panel logins or billing/payment card data were accessed, since it does not store full card numbers.
Technical Details
The compromise stemmed from exploitation of a vulnerability in third-party software underlying the File Manager web interface. DreamHost removed the affected servers, patched the exploited flaw, preserved the compromised server for forensics, and rebuilt and relaunched File Manager with added security controls and monitoring. It also rotated potentially exposed internal credentials and is reviewing other customer-facing tools for similar weaknesses. The company clarified the incident is unrelated to recent PHP server updates and that its forensic investigation is ongoing.
Remediation
Affected customers should treat FTP/SFTP and webmail credentials used during the exposure window as compromised and change them via the account control panel (only the account holder can reset passwords; changes take up to 15 minutes). Users should update saved credentials in email and file-transfer clients, avoid password reuse, inspect website files for unauthorized modifications, review mailbox forwarding rules and filters, and remain alert to phishing—DreamHost stated its incident emails never request passwords or contain sign-in links.