DreamHost has confirmed that unauthorized third parties gained access to the File Manager running on files.dreamhost.com. The company detected the intrusion on Friday, October 23, 2026, and promptly shut down the File Manager servers, fixed the exploited software defect, and initiated an investigation. DreamHost Confirms Cyberattack The company announced the incident as a deliberate attack, noting that its team worked tirelessly to mitigate the situation.
Campaigns targeting AI accounts highlight how stolen session cookies and tokens allow criminals to resume access without a new login. DreamHost has preserved the compromised File Manager server for forensic analysis, rebuilt the service with additional security measures, and enhanced monitoring. Hosting control panels are highly valued targets, as evidenced by recent cPanel and WHM vulnerabilities that allow for root code execution and administrator session hijacking.
DreamHost suggests these steps: - Use strong, unique passwords for every account - Update email, FTP, and SFTP clients to store new credentials - Review website files for any unauthorized changes - Check webmail forwarding rules and filters for entries not created by the user - Be cautious of potential follow-up phishing attempts It never sends an email requesting a password, and its notifications never prompt users to sign in via a link.
Since stolen credential logs frequently lead to subsequent intrusions, customers should promptly rotate exposed passwords.
