DreamHost has initiated a mandatory password reset for a subset of email, FTP, and SFTP accounts following a security incident that disrupted services for several days. The incident, which remains in a monitoring phase as of October 27, 2026, first surfaced on October 23 when users reported connectivity issues with the platform’s browser-based File Manager interface.
According to DreamHost’s official status updates, the investigation began at approximately 2:20 p.m. PDT on October 23. While a fix for the File Manager was deployed on the afternoon of October 26, the company opted to invalidate credentials for affected users as a precautionary measure. This reset prevents individual email or FTP users from accessing their accounts until the primary account owner performs a manual reset through the DreamHost control panel.
Beyond the Password Reset: Auditing Forwarding Rules
While the forced password reset addresses immediate unauthorized access, DreamHost is urging account owners to perform a deeper security audit. Specifically, the provider has instructed users to inspect their email forwarding settings for any unrecognized destinations. This directive indicates a concern that attackers may have established “shadow” forwarding rules, which would allow them to continue receiving copies of a user’s correspondence even after a password has been changed.
The incident primarily impacted the File Manager (files.dreamhost.com). Although DreamHost has not officially confirmed the root cause, some security researchers suggest the event may be linked to a vulnerability in Monsta FTP, the third-party software that powers the DreamHost browser-based file management tool. There are ongoing discussions regarding potential vulnerabilities in the software, though no specific CVE has been formally cited by the vendor in relation to this disruption.
Timeline of the Incident
The service disruption and subsequent security response followed a specific timeline over the last 72 hours:
- October 23, 2:20 p.m. PDT: Initial reports of connectivity issues with the File Manager interface.
- October 24–25: Ongoing investigation into service instability and potential unauthorized access.
- October 26, 3:35 p.m. PDT: DreamHost pushes a fix for the File Manager and begins the forced password reset process for affected sub-accounts.
- October 27: The incident is moved to “Monitoring” status; services remain online while users continue the recovery process.
For those managing automated deployment pipelines or websites that rely on SFTP credentials, the forced resets may have broken active connections. Administrators must update these credentials manually within their deployment tools to restore functionality. DreamHost emphasizes that because individual users cannot reset their own passwords during this incident, the primary account owner must take direct action within the “Manage Users” section of the administrative panel.
