DreamHost File Manager: exploited flaw exposed FTP/SFTP passwords and some webmail logins, Aug to Oct 2026
Severity: high · Patch status: patched · Since 2026-11-04
DreamHost, a US hosting provider and domain registrar, says an unauthorized party exploited a flaw in the File Manager software on its files.dreamhost.com server and had access from roughly August 2026 until DreamHost discovered it on 23 October 2026. During that window the intruder obtained the FTP/SFTP usernames and passwords of users who logged into File Manager, and the login credentials of a limited number of webmail users; in a small number of cases it may have used those credentials to view mailbox contents. DreamHost says control panel logins and billing data were not accessed, and that well under about 10% of email and FTP/SFTP accounts were affected; it gives no absolute count and does not name a CVE or vulnerability class. DreamHost took File Manager offline, preserved the server for forensics, reset passwords for affected email and FTP/SFTP users, ended sessions, brought in outside forensic specialists and says it is notifying regulators. The notice reports no website tampering or misuse beyond that mailbox viewing; its checks on website files and webmail forwarding rules are precautionary. Owners are told to treat the exposed FTP/SFTP credentials as compromised, change them and any reused passwords, and update clients that still store the old ones.
What to do
- Treat FTP/SFTP usernames and passwords used on DreamHost File Manager before 23 October 2026 as compromised, and set new ones (account holders can reset passwords at panel.dreamhost.com)
- Use a strong, unique password for every user on the DreamHost account, and change any password reused elsewhere
- Update email, FTP and SFTP clients that still have the old passwords saved
- Check hosted website files for changes you do not recognise
- Check webmail forwarding rules and filters for anything you did not set up yourself
- If you believe personal data was exposed, consider a fraud alert or credit freeze; BleepingComputer reports a one-year Equifax monitoring offer in DreamHost letters, which the web notice does not mention
Sources
All live incidents on Threat Watch
