Vendor incident, severity critical

DreamHost File Manager breached; customer FTP/SFTP logins and webmail sessions exposed

Published November 4, 2026

Attackers exploited a vulnerability in the web-based File Manager server at files.dreamhost.com and stole FTP/SFTP usernames and passwords of users who logged in between about August 2026 and October 23, 2026. The intruder may also have accessed webmail systems, exposing session information including credentials for a limited number of users. DreamHost says it blocked the attackers, fixed the vulnerability, ended active sessions and invalidated passwords.

What's affected

• dreamhostevery version

What to do

1. Reset FTP/SFTP and email passwords for DreamHost accounts
2. Check website files for unauthorized changes
3. Review webmail forwarding rules and filters
4. Change passwords on any other accounts that reuse the same credentials

Secrets to rotate if you were affected

Platform tokens.

Check whether you were affected

Pharon tells teams automatically when this affects something they run. To check a machine, run this in Claude Code with the Pharon plugin, in the repository that uses it:

/pharon:check-incident dreamhost-file-manager-breach-2026-11

References

• https://www.bleepingcomputer.com/news/security/dreamhost-confirms-data-breach-exposed-ftp-logins-and-webmail-sessions/

Notice dreamhost-file-manager-breach-2026-11, signed with key feed-prod-2026-10 (Ed25519). The Pharon CLI verifies the signature before using a notice.