DreamHost Data Breach via Third-Party File Manager Flaw Exposes FTP/SFTP and Webmail Credentials

Key facts for DreamHost File Manager breach

Detection coverage for DreamHost File Manager breach

As of 2026-11-05, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5290 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Web-Executable File Uploaded via FTP/SFTP (TL-2026-5290)

Detects uploads of server-side script files (php, phtml, phar, cgi, jsp, aspx) over FTP. DreamHost advised customers to inspect website files for unauthorized changes because stolen FTP/SFTP credentials permit uploads (TL-2026-5290). Uploaded scripts may act as web shells.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1105, T1071.002, T1505.003
• Data sources: vsftpd, linux_syslog, auditd_file_events
• Severity: high
• Confidence: medium

Splunk SPL

index=ftp sourcetype=vsftpd "OK UPLOAD" earliest=-24h
| rex "\[(?<user>[^\]]+)\] OK UPLOAD: Client \"(?<src_ip>[^\"]+)\", \"(?<file>[^\"]+)\""
| where match(file, "(?i)\.(php|phtml|phar|cgi|pl|jsp|aspx?)$")
| stats count values(file) as files min(_time) as first_seen by user src_ip
| convert ctime(first_seen)

Microsoft KQL

Syslog
| where TimeGenerated > ago(24h)
| where ProcessName =~ 'vsftpd' and SyslogMessage has 'OK UPLOAD'
| parse SyslogMessage with * '[' FtpUser '] OK UPLOAD: Client "' SrcIp '", "' FilePath '",' *
| where FilePath has_any ('.php', '.phtml', '.phar', '.cgi', '.jsp', '.aspx')
| summarize Uploads = count(), Files = make_set(FilePath, 20), FirstSeen = min(TimeGenerated) by FtpUser, SrcIp, Computer

Sigma

title: Web Script File Written by SFTP or FTP Daemon (TL-2026-5290)
id: a4f2b6d9-1e07-4c35-8b2a-5d9e0c7f1303
status: experimental
description: Detects server-side script files created by an FTP or SFTP daemon in a web root, consistent with abuse of stolen FTP/SFTP credentials to plant web shells.
references:
    - https://www.dreamhost.com/news/announcements/october-security-incident/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/05
tags:
    - attack.command-and-control
    - attack.t1105
    - attack.t1071.002
    - attack.persistence
    - attack.t1505.003
logsource:
    category: file_event
    product: linux
detection:
    selection_proc:
        Image|endswith:
            - '/sftp-server'
            - '/vsftpd'
            - '/proftpd'
    selection_file:
        TargetFilename|endswith:
            - '.php'
            - '.phtml'
            - '.phar'
    selection_path:
        TargetFilename|contains:
            - '/public_html/'
            - '/www/'
            - '/htdocs/'
    condition: selection_proc and selection_file and selection_path
falsepositives:
    - Developers deploying PHP sites over SFTP
    - CMS plugin or theme updates pushed by FTP
level: medium

Known false positives:

• Developers deploying PHP sites over SFTP
• CMS plugin or theme updates pushed by FTP

Tuning notes: Restrict to accounts and source IPs that should not deploy code, and allowlist known CI or deployment hosts. For proftpd or SFTP-only hosts, adapt the rex to that log format.

• 🔒 SSH/SFTP Password Login from Previously Unseen Source IP (TL-2026-5290) · unlock with TL Creds
• 🔒 Mailbox-Level External Forwarding Configured (TL-2026-5290) · unlock with TL Creds
• 🔒 Lookalike DreamHost Domain in Email URLs (Fake Reset Phishing) (TL-2026-5290) · unlock with TL Creds
• 🔒 Command Parameters Sent to Scripts in Upload Directories (Web Shell Use) (TL-2026-5290) · unlock with TL Creds
• 🔒 Bulk Mailbox Item Access (MailItemsAccessed Burst) (TL-2026-5290) · unlock with TL Creds
• 🔒 Outbound FTP/SFTP Transfer to External Host (TL-2026-5290) · unlock with TL Creds
• 🔒 DreamHost File Manager Exploitation Patterns in Web Logs (TL-2026-5290) · unlock with TL Creds
• 🔒 Mailbox Inbox Rule Forwarding to External Destination (TL-2026-5290) · unlock with TL Creds

Indicators of compromise for DreamHost File Manager breach

As of 2026-11-05, Threadlinqs Intelligence tracks 9 indicators of compromise for TL-2026-5290.

Sample indicators (1 of 9)

• Domain: dreamhoststatus[.]com

Defanged, TLP:CLEAR. Full set of 9 indicators: unlock with TL Creds.

How DreamHost File Manager breach works

On Friday afternoon, October 23, 2026, DreamHost detected unauthorized access to the server running its browser-based File Manager at files.dreamhost.com. The File Manager is built on third-party software; DreamHost states the unauthorized party exploited a vulnerability in that software. The vendor notice does not name the software, describe the flaw, or assign a CVE, so no CVE or CWE is recorded here.

The attacker was able to obtain the FTP/SFTP usernames and passwords of customers who logged into File Manager before the activity was detected. DreamHost says any FTP/SFTP user who logged into File Manager between approximately August 2026 and October 23, 2026 should treat those credentials as compromised. The attacker also reached certain webmail systems and obtained login credentials for a limited number of webmail users; in a small number of cases those credentials may have been used to view mailbox contents. DreamHost estimates the affected population at well under approximately 10% of its hosted email and FTP/SFTP accounts. DreamHost reports no evidence that control panel logins or customer billing details were accessed, and says payment card data is handled by an external processor.

Response: File Manager was taken offline for forensics, affected passwords were reset and active sessions ended the same day (October 23), and DreamHost rotated internal credentials, retained outside security experts and rebuilt the File Manager servers with additional safeguards and enhanced monitoring. Customers experienced lockouts from email, webmail and FTP/SFTP until account owners reset passwords; DreamHost said it cannot contact individual mailbox or FTP users directly. File Manager was restored on Monday, October 26. DreamHost published its security incident notice on October 29, 2026, and says regulatory notifications and formal notices are underway.

Defender guidance from DreamHost: reset passwords only through the control panel (type panel.dreamhost.com directly rather than following email links), use unique credentials, update saved passwords in email/FTP/SFTP clients, inspect website files for unauthorized changes, review webmail forwarding rules and filters and remove unrecognized forwarding destinations, and change the old password anywhere it was reused. DreamHost also warned of fraudulent password-reset emails and stated it will never email asking for a password. No threat actor, malware, attacker infrastructure or IOCs have been disclosed, and the root cause remained officially unexplained in early coverage; some customers speculated about a link to recent PHP vulnerabilities, which is unconfirmed speculation. Severity HIGH is analyst-assigned, not a source-stated rating.

MITRE ATT&CK techniques by tactic:

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application

Collection

T1114 Email Collection; T1114.003 Email Forwarding Rule

Credential Access

T1212 Exploitation for Credential Access

Remediation for DreamHost File Manager breach

Patches

• DreamHost addressed the vulnerability and rebuilt File Manager servers with additional safeguards and enhanced monitoring; no customer-side patch is required

Immediate actions

• Reset FTP/SFTP and email passwords via the DreamHost control panel (type panel.dreamhost.com directly; do not follow email links)
• Treat FTP/SFTP credentials used in File Manager between approximately August 2026 and October 23, 2026 as compromised
• Review webmail forwarding rules and filters and remove any forwarding destination that is not recognized
• Inspect website files for unauthorized changes
• Change the old password anywhere else it was reused
• Notify mailbox and FTP users, since DreamHost cannot contact them directly

Workarounds

• Update saved credentials in email and FTP/SFTP clients after reset
• Disregard emails requesting passwords; DreamHost states it will never ask for a password by email

Longer-term hardening

• Use strong, unique credentials per service and a password manager
• Prefer key-based SFTP authentication where supported and restrict by source IP
• Monitor FTP/SFTP and webmail logins for anomalous source addresses
• Enable multi-factor authentication where the provider supports it
• Review third-party web applications exposed on hosting infrastructure for patch status

Affected and fixed versions

• DreamHost — File Manager (files.dreamhost.com) and webmail
  Vulnerable versions: Third-party File Manager software, version not disclosed; exposure window approximately August 2026 to October 23, 2026
  Fixed in: File Manager rebuilt and restored October 26, 2026

Timeline of DreamHost File Manager breach

• 2026-08-01 Approximate start of the exposure window: locked-ioc-9 says FTP/SFTP users who logged into File Manager from approximately August 2026 should treat their credentials as compromised (exact date not disclosed; first of month used as placeholder for 'approximately August').
• 2026-10-23 Evening: incident expands to FTP/SFTP and webmail access; mandatory password resets begin for affected email and FTP/SFTP users.
• 2026-10-23 locked-ioc-9 detects unauthorized access to the server running the File Manager (locked-ioc-5) on Friday afternoon; File Manager taken offline and affected passwords reset and active sessions ended the same day.
• 2026-10-24 Password resets completed; affected users locked out until account owners reset credentials.
• 2026-10-25 Account owners notified by email with reset instructions and advised to remove unrecognized email forwarding destinations.
• 2026-10-26 File Manager restored after rebuild with additional safeguards and enhanced monitoring; BleepingComputer and Webhosting Today publish first public coverage of the resets.
• 2026-10-29 locked-ioc-9 publishes its security incident notice confirming exploitation of a third-party software vulnerability, theft of FTP/SFTP and some webmail credentials, and limited mailbox access; regulatory notifications underway.
• 2026-11-05 Cyber Security News reports the confirmed breach, prompting this intelligence entry.

Sources cited for DreamHost File Manager breach

• File Manager interface service disruption (DreamHost status incident 675722, via IsDown) isdown.app · Advisory · 2026-10-23
• DreamHost - October Security Incident dreamhost.com · Vendor report · 2026-10-29
• DreamHost forces email, FTP/SFTP password resets in ongoing incident (BleepingComputer) BleepingComputer · News · 2026-10-26
• Unexplained DreamHost Incident Prompts Email, FTP Password Resets (SecurityWeek) SecurityWeek · News · 2026-10-27
• DreamHost incident triggers password resets, locks customers out of email and FTP accounts (Help Net Security) Help Net Security · News · 2026-10-27
• DreamHost urges affected owners to reset every email and FTP password (Webhosting Today) webhosting.today · News · 2026-10-26
• DreamHost Confirms Data Breach - Hackers Stole Customer Credentials and Accessed Emails (Cyber Security News) cybersecuritynews.com · News · 2026-11-05

More in data breach

• Chainalysis breach via agentic on-path (AitM) attack exposes user credentials and live authentication tokens
• WorkOS Internal Sales App Breached by Attacker Using ARTEX AI Offensive Framework
• Frontline Education Data Breach via Third-Party Software Vulnerability Impacts Over 1.3 Million People
• Chainalysis Confirms Cyberattack: Unauthorized Access to Internal Tools via 'Offensive Agentic Techniques' Exposes Customer Account Data
• Binance security incident: compromised DevOps engineer laptop leads to service container access and ~$6.3 billion in unauthorized withdrawals