Security Alert: DreamHost Confirms Two-Month Breach of File Manager Platform

DreamHost, a prominent web hosting service, has announced a security incident involving its File Manager platform. The breach lasted for two months, during which attackers gained unauthorized access to customers' FTP/SFTP credentials and active webmail sessions. FTP/SFTP credentials are vital for managing websites, giving attackers the ability to alter source code, embed malicious scripts, or delete critical data.

Access to active webmail sessions could potentially bypass multi-factor authentication (MFA), granting unauthorized access to sensitive communications and password reset links. The attackers held this position for an extended period, increasing the risk of unnoticed alterations in hosted environments. Recent reports highlight a series of significant infrastructure and supply-chain attacks, including a compromise of cPGuard's update infrastructure and an alleged breach at WorkOS, where an AI tool was allegedly used to access internal sales applications and customer communications.

The DreamHost breach specifically impacted the File Manager platform, and while the precise number of affected accounts is unknown, the full scale of potential damage remains unclear. For individuals managing sites on DreamHost or utilizing cPGuard, it is advised to immediately change all credentials, audit file integrity using version control systems, terminate active webmail sessions, and review server logs for suspicious activity.