# DreamHost Data Breach via Third-Party File Manager Flaw Exposes FTP/SFTP and Webmail Credentials

> DreamHost disclosed that an unauthorized third party exploited a vulnerability in third-party software behind its web-based File Manager (files.dreamhost.com), detected October 23, 2026. FTP/SFTP credentials of users who logged into File Manager and a limited number of webmail credentials were obtained, and some mailbox contents may have been viewed; DreamHost says well under approximately 10% of hosted email and FTP/SFTP accounts were affected.

- **Published:** 2026-11-05T03:26:56Z
- **Last reviewed:** 2026-11-05T03:26:56Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5290
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5290.png
- **ID:** TL-2026-5290
- **Severity:** HIGH
- **Category:** DATA_BREACH
- **Status:** MONITORING
- **Detections:** 9 (1 shown free below) · **IOCs:** 9 (1 shown free below)

## Description

On Friday afternoon, October 23, 2026, DreamHost detected unauthorized access to the server running its browser-based File Manager at files.dreamhost.com. The File Manager is built on third-party software; DreamHost states the unauthorized party exploited a vulnerability in that software. The vendor notice does not name the software, describe the flaw, or assign a CVE, so no CVE or CWE is recorded here.

The attacker was able to obtain the FTP/SFTP usernames and passwords of customers who logged into File Manager before the activity was detected. DreamHost says any FTP/SFTP user who logged into File Manager between approximately August 2026 and October 23, 2026 should treat those credentials as compromised. The attacker also reached certain webmail systems and obtained login credentials for a limited number of webmail users; in a small number of cases those credentials may have been used to view mailbox contents. DreamHost estimates the affected population at well under approximately 10% of its hosted email and FTP/SFTP accounts. DreamHost reports no evidence that control panel logins or customer billing details were accessed, and says payment card data is handled by an external processor.

Response: File Manager was taken offline for forensics, affected passwords were reset and active sessions ended the same day (October 23), and DreamHost rotated internal credentials, retained outside security experts and rebuilt the File Manager servers with additional safeguards and enhanced monitoring. Customers experienced lockouts from email, webmail and FTP/SFTP until account owners reset passwords; DreamHost said it cannot contact individual mailbox or FTP users directly. File Manager was restored on Monday, October 26. DreamHost published its security incident notice on October 29, 2026, and says regulatory notifications and formal notices are underway.

Defender guidance from DreamHost: reset passwords only through the control panel (type panel.dreamhost.com directly rather than following email links), use unique credentials, update saved passwords in email/FTP/SFTP clients, inspect website files for unauthorized changes, review webmail forwarding rules and filters and remove unrecognized forwarding destinations, and change the old password anywhere it was reused. DreamHost also warned of fraudulent password-reset emails and stated it will never email asking for a password. No threat actor, malware, attacker infrastructure or IOCs have been disclosed, and the root cause remained officially unexplained in early coverage; some customers speculated about a link to recent PHP vulnerabilities, which is unconfirmed speculation. Severity HIGH is analyst-assigned, not a source-stated rating.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1212 Exploitation for Credential Access
- T1078 Valid Accounts
- T1114 Email Collection
- T1114.003 Email Forwarding Rule

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Web-Executable File Uploaded via FTP/SFTP (TL-2026-5290)** (`TL-2026-5290-SPL-003`)

Detects uploads of server-side script files (php, phtml, phar, cgi, jsp, aspx) over FTP. DreamHost advised customers to inspect website files for unauthorized changes because stolen FTP/SFTP credentials permit uploads (TL-2026-5290). Uploaded scripts may act as web shells.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1105, T1071.002, T1505.003
- **Data sources:** vsftpd, linux_syslog, auditd_file_events
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

```spl
index=ftp sourcetype=vsftpd "OK UPLOAD" earliest=-24h
| rex "\[(?<user>[^\]]+)\] OK UPLOAD: Client \"(?<src_ip>[^\"]+)\", \"(?<file>[^\"]+)\""
| where match(file, "(?i)\.(php|phtml|phar|cgi|pl|jsp|aspx?)$")
| stats count values(file) as files min(_time) as first_seen by user src_ip
| convert ctime(first_seen)
```

### Microsoft KQL

```kql
Syslog
| where TimeGenerated > ago(24h)
| where ProcessName =~ 'vsftpd' and SyslogMessage has 'OK UPLOAD'
| parse SyslogMessage with * '[' FtpUser '] OK UPLOAD: Client "' SrcIp '", "' FilePath '",' *
| where FilePath has_any ('.php', '.phtml', '.phar', '.cgi', '.jsp', '.aspx')
| summarize Uploads = count(), Files = make_set(FilePath, 20), FirstSeen = min(TimeGenerated) by FtpUser, SrcIp, Computer
```

### Sigma

```yaml
title: Web Script File Written by SFTP or FTP Daemon (TL-2026-5290)
id: a4f2b6d9-1e07-4c35-8b2a-5d9e0c7f1303
status: experimental
description: Detects server-side script files created by an FTP or SFTP daemon in a web root, consistent with abuse of stolen FTP/SFTP credentials to plant web shells.
references:
    - https://www.dreamhost.com/news/announcements/october-security-incident/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/05
tags:
    - attack.command-and-control
    - attack.t1105
    - attack.t1071.002
    - attack.persistence
    - attack.t1505.003
logsource:
    category: file_event
    product: linux
detection:
    selection_proc:
        Image|endswith:
            - '/sftp-server'
            - '/vsftpd'
            - '/proftpd'
    selection_file:
        TargetFilename|endswith:
            - '.php'
            - '.phtml'
            - '.phar'
    selection_path:
        TargetFilename|contains:
            - '/public_html/'
            - '/www/'
            - '/htdocs/'
    condition: selection_proc and selection_file and selection_path
falsepositives:
    - Developers deploying PHP sites over SFTP
    - CMS plugin or theme updates pushed by FTP
level: medium
```

**Known false positives:**

- Developers deploying PHP sites over SFTP
- CMS plugin or theme updates pushed by FTP

**Tuning notes:** Restrict to accounts and source IPs that should not deploy code, and allowlist known CI or deployment hosts. For proftpd or SFTP-only hosts, adapt the rex to that log format.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- SSH/SFTP Password Login from Previously Unseen Source IP (TL-2026-5290) (locked: unlock with TL Creds)
- Mailbox-Level External Forwarding Configured (TL-2026-5290) (locked: unlock with TL Creds)
- Lookalike DreamHost Domain in Email URLs (Fake Reset Phishing) (TL-2026-5290) (locked: unlock with TL Creds)
- Command Parameters Sent to Scripts in Upload Directories (Web Shell Use) (TL-2026-5290) (locked: unlock with TL Creds)
- Bulk Mailbox Item Access (MailItemsAccessed Burst) (TL-2026-5290) (locked: unlock with TL Creds)
- Outbound FTP/SFTP Transfer to External Host (TL-2026-5290) (locked: unlock with TL Creds)
- DreamHost File Manager Exploitation Patterns in Web Logs (TL-2026-5290) (locked: unlock with TL Creds)
- Mailbox Inbox Rule Forwarding to External Destination (TL-2026-5290) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (1 of 9)

Defanged, TLP:CLEAR.

- Domain: `dreamhoststatus[.]com`

Full set of 9 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [DreamHost - October Security Incident](https://www.dreamhost.com/news/announcements/october-security-incident/)
- [DreamHost forces email, FTP/SFTP password resets in ongoing incident (BleepingComputer)](https://www.bleepingcomputer.com/news/security/dreamhost-forces-email-ftp-sftp-password-resets-in-ongoing-incident/)
- [Unexplained DreamHost Incident Prompts Email, FTP Password Resets (SecurityWeek)](https://www.securityweek.com/unexplained-dreamhost-incident-prompts-email-ftp-password-resets/)
- [DreamHost incident triggers password resets, locks customers out of email and FTP accounts (Help Net Security)](https://www.helpnetsecurity.com/?p=389210)
- [DreamHost urges affected owners to reset every email and FTP password (Webhosting Today)](https://webhosting.today/2026/10/26/dreamhost-urges-affected-owners-to-reset-every-email-and-ftp-password/)
- [File Manager interface service disruption (DreamHost status incident 675722, via IsDown)](https://isdown.app/status/dreamhost/incidents/675722-file-manager-interface-service-disruption)
- [DreamHost Confirms Data Breach - Hackers Stole Customer Credentials and Accessed Emails (Cyber Security News)](https://cybersecuritynews.com/dreamhost-confirms-data-breach/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5290