DreamHost confirms breach via File Manager flaw: attackers had access from August to Oct 23, 2026, stealing FTP/SFTP credentials and sessions
Matéria consolidada. Reúne 6 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 4 fontes trouxeram em 05/11/2026 00:07; os links antigos trazem para cá.
Fontes: techcrunch.com ↗ bleepingcomputer.com ×2 ↗ securityweek.com ↗ gbhackers.com ↗
DreamHost, a U.S. web hosting provider and domain registrar, has confirmed a data breach. Attackers exploited a vulnerability in its web-based File Manager (files.dreamhost.com) from approximately August 2026 until the intrusion was discovered on October 23, 2026 (bleepingcomputer.com, techcrunch.com). The incident first appeared that day as connectivity problems with File Manager, then spread to webmail and FTP/SFTP access, and DreamHost expired email and FTP/SFTP passwords, initially calling this a precaution (bleepingcomputer.com, gbhackers.com). DreamHost now says the attacker stole FTP/SFTP usernames and passwords of users who logged into File Manager during the window and may have accessed webmail session information, including credentials for a limited number of users (bleepingcomputer.com). TechCrunch, citing a notice filed with the California Attorney General, says the attackers stole session tokens to hijack authenticated sessions, and that affected customers are "well under 10%" of roughly 400,000 paying customers (techcrunch.com). DreamHost found no evidence of access to control panel logins or billing/payment data, and says the compromise is unrelated to recently disclosed PHP vulnerabilities. It declined to name the flaw or explain the detection delay, citing an ongoing investigation (bleepingcomputer.com, techcrunch.com). It blocked the attacker and patched the flaw, and restored File Manager on October 26 at 3:35 p.m. PDT before moving the incident to monitoring (gbhackers.com, securityweek.com). Mailboxes kept receiving messages, and FTP/SFTP data remains on DreamHost servers (gbhackers.com). Customers complained about poor communication during the outage (bleepingcomputer.com).
Entenda a falha
A vulnerabilidade
An unspecified vulnerability in the software behind DreamHost's web-based File Manager (files.dreamhost.com) was exploited. DreamHost has not named the flaw or its type, and no CVE exists. The articles give no affected or fixed versions and do not say what an attacker needs, such as authentication or user interaction. The company says it blocked the attacker and patched the flaw. The attacker gained access to the server running File Manager and obtained the FTP/SFTP usernames and passwords of users who logged in between about August 2026 and October 23, 2026. Webmail session information, including credentials for a limited number of users, may also have been accessed. TechCrunch reports stolen session tokens.
Como funciona
The articles do not describe the technical flow. What is known: an unauthorized third party exploited a flaw in the File Manager software and reached the server running it. From there, credentials that users typed into File Manager at login were exposed, and webmail session data may have been reached as well. TechCrunch adds that session tokens, which keep a user logged in, were stolen, so an attacker could act as that user without a password. The step at which the software fails is not disclosed.
Por que é vulnerável
The root cause has not been disclosed. DreamHost calls it a vulnerability in the File Manager software and declined to detail it or to explain why the intrusion went undetected from August until October 23, citing an ongoing investigation. The company says it is unrelated to the recently disclosed PHP vulnerabilities. What the fix changes is not stated.
Como foi descoberta
The intrusion was discovered on October 23, 2026, when DreamHost reported connectivity problems with File Manager, which then spread to webmail and FTP/SFTP and led to forced password resets, first called a precaution. The articles do not say who found the flaw or how. On November 4, a breach notification (reported by BleepingComputer and, via a filing with the California Attorney General, by TechCrunch) confirmed the breach and dated it from about August 2026. The attack appears deliberate. DreamHost says well under 10% of its roughly 400,000 paying customers are affected.
Explicação gerada por IA a partir da matéria e dos artigos, em 05/11/2026 00:22.
Detalhes técnicos
- Root cause: an unspecified software vulnerability in the File Manager service gave the attacker unauthorized server access. DreamHost has not named the flaw, and no CVE has been published (bleepingcomputer.com, techcrunch.com).
- Exposure window: approximately August 2026 to October 23, 2026, when the intrusion was discovered. The attack appears deliberate (bleepingcomputer.com, techcrunch.com).
- Data exposed: FTP/SFTP usernames and passwords entered by customers in File Manager during the window (bleepingcomputer.com). Webmail session information, including credentials for a limited number of users, may also have been exposed (bleepingcomputer.com).
- Session tokens: TechCrunch reports the attackers stole session tokens that keep users authenticated after login. A token lets an attacker impersonate the user and reach the account, inboxes and files without a password (techcrunch.com).
- No evidence of access to control panel logins or billing/payment data, which is handled by an external provider (bleepingcomputer.com).
- Scope: "well under 10%" of roughly 400,000 paying customers (techcrunch.com). No exact count has been published.
- The compromise is unrelated to recently disclosed PHP vulnerabilities (techcrunch.com).
- Affected services during the incident: File Manager, DreamHost webmail, and email and FTP/SFTP authentication (gbhackers.com, securityweek.com).
- Recovery instructions were sent in batches over the weekend to the affected account owners (bleepingcomputer.com).
- Only the account owner can set new passwords. DreamHost cannot contact individual mailbox or FTP users directly (bleepingcomputer.com, securityweek.com).
- A "Failed to edit" error that blocked some Professional Email customers from setting new passwords was fixed on October 25 (gbhackers.com).
- DreamHost advises reviewing mailbox forwarding rules and removing unrecognized destinations. Given the webmail session exposure, this fits possible external mailbox access (bleepingcomputer.com), though earlier guidance did not confirm that attackers changed any rules (gbhackers.com).
- Some users speculated that passwords were compromised and questioned how they were hashed. DreamHost has not addressed the hashing question (securityweek.com).
- No attribution, malware or IOCs have been published.
Remediação
- DreamHost blocked the attacker's access, patched the exploited vulnerability, terminated active sessions for potentially affected accounts and invalidated passwords (bleepingcomputer.com).
- Account owners should set new passwords in the DreamHost panel: Mail > Manage Email for email accounts, and Websites > SFTP Users & Files for FTP/SFTP users. Changes can take up to 15 minutes to apply (gbhackers.com).
- Update saved passwords in email clients and file-transfer software, and use strong, unique passwords per user (gbhackers.com).
- Check website files for unauthorized changes (bleepingcomputer.com).
- Check every mailbox for forwarding rules and filters, and remove any unrecognized destination (bleepingcomputer.com, gbhackers.com).
- Change the password on any other service where the old DreamHost password was reused (bleepingcomputer.com, securityweek.com).
- Consider a credit freeze or fraud alert. DreamHost offers one year of free credit monitoring and identity theft protection through Equifax (bleepingcomputer.com).
- Notify mailbox and FTP users through out-of-band channels such as phone or secure text, not a DreamHost-hosted mailbox (bleepingcomputer.com, gbhackers.com).
- DreamHost says it never requests password resets by email. Treat such messages as suspicious and go directly to the panel instead of following login links (gbhackers.com, securityweek.com).
Relatos divergentes
- File Manager status: BleepingComputer (Oct 26) said the incident was active and File Manager still unavailable. GBHackers (Oct 27) and SecurityWeek (Oct 27) report a fix and restoration on October 26, with monitoring continuing. The later reports are more current.
- Scope of resets: BleepingComputer describes access blocked for all users until the owner sets new credentials. GBHackers and SecurityWeek say "certain" or "some" email and FTP/SFTP accounts were reset. TechCrunch (Nov 4) puts affected customers at "well under 10%" of about 400,000, the most specific figure so far. DreamHost has not published exact numbers.
- Possible mailbox access: BleepingComputer read the forwarding-rule advice as suggesting external access. GBHackers said it did not confirm any attacker changes, and SecurityWeek noted no evidence of data theft or attacker activity. The later BleepingComputer report (Nov 4) says DreamHost confirmed a breach and that webmail session information may have been accessed, which supersedes the earlier "no evidence" and "precaution" framing.
- What was stolen: BleepingComputer (Nov 4) says FTP/SFTP usernames and passwords entered in File Manager, plus webmail session information. TechCrunch (Nov 4) emphasizes stolen session tokens that bypass passwords, with access to inboxes and files. Both cite the same breach, and DreamHost has not published a technical breakdown.
- Start of the incident: Earlier reports (Oct 26-27) dated the incident to October 23. The Nov 4 reports (bleepingcomputer.com, techcrunch.com) say October 23 was the discovery date and the intrusion began around August 2026, so the later reports are more current.
Linha do tempo
-
DreamHost Confirms Months-Long Breach Exposing Customer Files and Email Inboxes
ler a análise desta fonte ocultar
DreamHost has disclosed a data breach in which attackers maintained unauthorized access to its systems for several months before detection. According to a notice filed with the California Attorney General, the intrusion began in August 2026 and was only discovered and disclosed last Thursday, following a multi-day outage during which DreamHost reset some customer passwords. The attackers exploited an unspecified vulnerability in DreamHost's file manager feature, used by customers to store files, to steal session tokens that allowed them to hijack authenticated user sessions without needing passwords. DreamHost stated the compromise is unrelated to recently disclosed PHP vulnerabilities. The company declined to detail the exploited flaw or explain the detection delay, citing an ongoing investigation, but said affected customers represent "well under 10%" of its roughly 400,000 paying customers.
Technical Details
Attackers exploited a vulnerability in DreamHost's file manager to steal session tokens, which keep users authenticated after login. Possession of these tokens allows an attacker to impersonate the legitimate user and access their account without credentials. Stolen data reportedly includes customer emails and credentials, as well as access to customer inboxes and files.
Remediation
DreamHost reset passwords for some affected customers following the outage. The company has not disclosed the specific vulnerability or provided guidance beyond the password resets at the time of reporting.
-
DreamHost Confirms Two-Month Breach Exposing FTP/SFTP Credentials and Webmail Sessions
ler a análise desta fonte ocultar
DreamHost, a US-based web hosting provider and domain registrar, has confirmed a data breach after attackers exploited a vulnerability in its web-based File Manager platform at files.dreamhost.com. The intrusion lasted from approximately August 2026 to October 23, 2026, when it was discovered, and allowed the unauthorized third party to steal FTP/SFTP usernames and passwords of users who logged into the File Manager during that window. The attacker may have also accessed webmail systems, exposing session information including credentials for a limited number of users. DreamHost states the attack appears deliberate and that it found no evidence of access to control panel logins or billing/payment data, which is handled by an external provider.
Technical Details
The attacker exploited a software vulnerability in the File Manager service to gain unauthorized server access, harvesting FTP/SFTP credentials entered by customers during the exposure period. Webmail session hijacking may have also occurred, giving the attacker access to session credentials for some users.
Remediation
DreamHost has blocked the attacker's access, patched the exploited vulnerability, terminated active sessions for potentially affected accounts, and invalidated passwords. Affected customers are advised to check website files for unauthorized changes, review webmail forwarding rules and filters, change reused passwords on other accounts, and consider a credit freeze or fraud alert. DreamHost is offering one year of free credit monitoring and identity theft protection through Equifax.
-
DreamHost suspends File Manager and resets email and FTP/SFTP passwords after unexplained incident
ler a análise desta fonte ocultar
Web hosting provider DreamHost suspended its File Manager (files.dreamhost.com) and reset passwords for some email and FTP/SFTP users over the weekend. The company cited only "an issue" with its systems that affected File Manager and DreamHost webmail, and described the resets as a precaution. It has not disclosed the root cause, the number of affected users, or whether credentials were exposed. Some users speculated that passwords were compromised and questioned whether they were properly hashed, and DreamHost has not confirmed either point. On Monday the company said it had deployed a fix and restored File Manager access, and that it was still monitoring the service. SecurityWeek has asked DreamHost about the scope and root cause.
Technical Details
- Affected services: File Manager at files.dreamhost.com and DreamHost webmail.
- Password resets applied to some email and FTP/SFTP users. Only the account owner can set the new passwords, and mailbox and FTP users are not contacted directly.
- DreamHost stated it would not request password resets via email.
- No evidence of data theft, attacker activity or password exposure was stated in the article.
Remediation
- Account owners should set new passwords for affected email and FTP/SFTP users and tell those users about the reset.
- Users who reused the old password elsewhere should change it on those services.
- Treat any email claiming to be a DreamHost password reset as suspicious, since DreamHost says it does not send them.
-
DreamHost forces password resets for email and FTP/SFTP accounts after File Manager and webmail incident
ler a análise desta fonte ocultar
DreamHost expired passwords for certain email and FTP/SFTP accounts after an incident that disrupted its File Manager and webmail services starting October 23, 2026. The company restored files.dreamhost.com on October 26 and moved the incident to a monitoring phase, but affected users still cannot authenticate until the main account owner assigns new passwords. Mailboxes kept receiving messages and FTP/SFTP data remains on DreamHost servers. The published updates do not state the root cause, the number of affected accounts, or whether there was unauthorized access or data theft, so the resets should not be read as confirmation of a credential breach.
Technical Details
- Disruption began October 23 with File Manager connectivity issues, later extending to webmail and FTP/SFTP access.
- Passwords for affected accounts were expired as a precaution while engineers investigated.
- A fix was deployed on October 26 (3:35 p.m. PDT) and File Manager was brought back online.
- A "Failed to edit" error that blocked some Professional Email customers from setting new passwords was fixed on October 25.
- DreamHost asks administrators to review mailbox forwarding rules and remove unrecognized destinations. The guidance does not confirm that attackers changed any forwarding rules.
Remediation
- Account owners reset credentials in the DreamHost panel: Mail > Manage Email for email accounts, Websites > SFTP Users & Files for FTP/SFTP users. Changes can take up to 15 minutes to apply.
- Update saved passwords in email clients and file-transfer software.
- Use strong, unique passwords for each user.
- Share new credentials through a private channel outside the DreamHost-hosted mailbox, such as a phone call or secure text.
- Review and remove unknown mailbox forwarding destinations.
- DreamHost never asks for passwords by email. Go directly to panel.dreamhost.com instead of following login links in messages.
-
DreamHost forces email and FTP/SFTP password resets during ongoing security incident
ler a análise desta fonte ocultar
DreamHost, a U.S. web hosting provider and domain registrar, has forced password resets for email and FTP/SFTP users after an incident that began on October 23 as connectivity problems with the File Manager interface and then spread to other services. The company blocked access for all users until the account owner sets new credentials, calling this a precaution. As of publication the incident remains active and File Manager is still unavailable. DreamHost has not disclosed the cause, the number of affected accounts, or whether files or messages were exposed. BleepingComputer's questions went unanswered, and customers are complaining about the lack of communication.
Technical Details
- The incident was first reported on October 23 as File Manager connectivity problems, then expanded to other services.
- Recovery instructions were sent in batches over the weekend to all affected account owners.
- DreamHost advises reviewing every email address for forwarding rules and removing any unrecognized forwarding destination. This suggests some mailboxes may have been accessed by external actors, but DreamHost has not confirmed it.
- DreamHost cannot contact individual mailbox or FTP users directly, so account owners must notify them by phone, text or other means.
- No attribution, malware, CVE or IOCs have been published.
Remediation
- Account owners should set new credentials for affected email and FTP/SFTP accounts.
- Check each mailbox for forwarding rules and remove any destination you do not recognize.
- Change the password on any other service where the old DreamHost password was reused.
- Notify affected mailbox and FTP users through out-of-band channels.