DreamHost File Manager Incident: What Site Owners Should Do

On the afternoon of Friday, 23 October 2026, DreamHost found that an unauthorized third party had reached the server running its browser-based File Manager at files.dreamhost.com. DreamHost said that File Manager is built on third-party software, and that it took the File Manager servers offline right away.

If your website or company email is hosted at DreamHost, this is worth an hour of your time. A File Manager is the browser screen where you upload pages and pictures. DreamHost says FTP and SFTP passwords for people who used that File Manager were accessed, along with a limited number of webmail logins. If you want a senior engineer with you for this, Able Rescue is $199 for up to two hours, any hour. Email greg@ableadmins.com and we will set a time.

What DreamHost reported

DreamHost said the attacker exploited a vulnerability in that software. The attacker then accessed the FTP and SFTP usernames and passwords of users who logged into File Manager before detection on 23 October 2026. DreamHost put that window at approximately August 2026 through that Friday.

FTP and SFTP are the usual ways to copy files onto a host, and the username and password are what make that copy possible.

The same notice covers mail. DreamHost said the attacker reached certain webmail systems and obtained login credentials for a limited number of webmail users. Passwords were reset, and active sessions ended, the same day. In a small number of cases, DreamHost believes those credentials may have been used to view mailbox contents.

DreamHost said its analysis shows the incident affected a fraction of hosted email and FTP/SFTP accounts, well under approximately 10%, and that it found no evidence of access to control panel logins or customer billing details. On 4 November 2026, TechCrunch reported that DreamHost disclosed the breach the previous Thursday after an outage spanning several days. TechCrunch reported that a DreamHost spokesperson said the number of affected customers was well under 10%, and that the incident was unrelated to the recent PHP vulnerabilities. DreamHost has said the incident was not related to recent PHP server updates. Read the full account in DreamHost's announcement.

Who should set a new password

You are in the group DreamHost described if people on your team signed into File Manager between approximately August 2026 and 23 October 2026, or if DreamHost reset an email or FTP/SFTP password on the account.

Only the account holder can set new passwords, in the panel at panel.dreamhost.com. A changed password may take up to 15 minutes to take effect. The owner of the DreamHost account is the person who saves the password.

What the status page shows

I pulled these times from DreamHost's status page. They are in Pacific daylight time.

At 5:20 PM PDT on 23 October, the panel File Manager was offline, and some webmail users were signed out or saw a login error.
At 10:13 PM PDT on 23 October, the issue included FTP/SFTP access and webmail, with password resets in progress.
At 10:37 AM PDT on 24 October, the password reset for affected email and FTP/SFTP users was complete.
At 3:35 PM PDT on 26 October, files.dreamhost.com was back online.
At 4:45 PM PDT on 27 October, the incident was resolved, and password resets were still required for a subset of those accounts.

DreamHost said websites and email remained available throughout. Inboxes continued to receive mail whether or not passwords had been reset. Read the updates in order on DreamHost's incident page.

What to look for on the account

DreamHost asked customers to check website files and webmail forwarding rules and filters for changes they did not make. You are looking for anything your own team did not add.

Confirm each affected email and FTP/SFTP user has a password you set in the panel after DreamHost's reset. Wait up to 15 minutes, then try it.
Open webmail forwarding and filters. If you find a forward, a filter, or an automatic reply your team did not create, remove it.
Look through the website files for pages changed since August 2026 that nobody on your team uploaded.
Ask anyone else who uses File Manager, FTP, or webmail on this account to use the new password.
Where a mailbox holds client notes, invoices, or mail from your other services, read what came in that weekend.

One pass, with the account holder signed in, is enough to see whether the account still looks like yours.

How Able can help

When the panel opens and the files look familiar, you can make this pass on your own. When a file will not upload, a mailbox will not open, or a folder holds something you have never seen, I will sit with you and work through it.

Able Rescue is $199 for up to two hours of senior remote help when production is down, any hour. Email greg@ableadmins.com with your domain and a sentence on what looks wrong. We will use the time on the panel, the files, and the mail rules.

Sources

If your DreamHost files or mailbox could use a calm second look, write me at greg@ableadmins.com or come through Able Rescue.