DreamHost File Manager breach exposed FTP/SFTP and some webmail passwords, forcing resets

Teaser from the source

On Oct 23 2026, web host DreamHost found that an attacker had broken into the server running its browser-based File Manager (files.dreamhost.com) by exploiting a vulnerability in the third-party software it is built on. DreamHost confirmed on Oct 29 that the attacker got the FTP/SFTP usernames and passwords of users who logged into File Manager between about August 2026 and Oct 23, reached some webmail systems and took a limited number of webmail logins, and may have read a small number of mailboxes. DreamHost reset the affected passwords, ended sessions, rebuilt File Manager and says well under 10% of email and FTP/SFTP accounts were affected, with no evidence that control panel logins or billing details were accessed. Affected users can't sign in until the account owner sets new passwords in the DreamHost panel.

This is the RSS-feed teaser. Read the full article at the original source.