DreamHost says attackers exploited a bug in its web-based File Manager and stole FTP/SFTP usernames and passwords from people who logged into it between about August 2026 and October 23, when the breach was found.
What’s known
- Webmail session info, including credentials, may have been exposed for a smaller group
- No evidence so far of control panel logins or billing data being taken
- DreamHost closed the hole, killed active sessions and invalidated passwords. It hasn’t said how many accounts were hit
What to do
- Check your site files for anything you didn’t put there
- Look at webmail forwarding rules and filters
- Change any other passwords that matched
My take
Two months of FTP passwords means two months for someone to drop a backdoor into a WordPress site. Don’t just reset and move on. Look at your files. Steps are in the how-to below.
God Bless, and May the Source Be with You!
