Active incident at Dreamhost forcing password reset

whyage

What's going on with Dreamhost lately? Is it falling apart?

therein

Now that's a blast to the past. What's next, Rapidshare.de is having issues?

duskwuff

Reading the tea leaves: given that the outage started with "connectivity issues affecting the File Manager", which was an install of Monsta FTP [1] - a commercial PHP application - I suspect the file manager got popped by one of the recently published PHP vulnerabilities, and users' FTP credentials may have been exfiltrated. [1]: https://www.monstaftp.com/

forgotmypw17

Ah, I noticed this yesterday, figured it was just me.

paulbjensen

Dreamhost - gosh that brings back memories…

hmokiguess

I migrated all my stuff from dreamhost about 5 years ago, got this email today and felt validated from having made that decision.

monster_truck

I used them for entirely too long, and only continued to do so because a classmate in high school used my referral code to sign up for the account that would become his career of selling and managing websites for local churches. I could not believe what the hell they were charging for a year of hosting with a dedicated ip (which they at the time required if you wanted https, real scumfuck move), so I didn't pay. I guess I hope they actually deleted my shit because I sure didn't get this email

xmddmx

Super displeased with DreamHost's handling of this. I have multiple master accounts. One of them got the email around 12pm today (over 48 hours after the incident started) saying... "As a precaution, we have expired the passwords for some email and FTP/SFTP users on your DreamHost account. Their old passwords no longer work, and no new password has been set." But none of those email passwords were actually expired - all were working. This is confusing - did they only expire passwords that were under threat? If a password wasn't expired, should it be trusted? The same email suggests you change all email passwords you control. Another account received no email warning from DreamHost so I assumed it was fine, but 7 hours later it also received the same generic email. My complaints: - sucks that it took them 48 hours to identify the breach - perhaps understandable - but once the breach was identified, how the fuck does it take them over 7 rolling hours to email their customers? That's terrible. - confusing messaging: DreamHost are claiming that passwords are expired, but in testing multiple accounts, all of them are still working. Do I need to rotate these? (I probably will just for safety). I'm a 25+ year DreamHost customer and generally satisfied, but this feels like amateur hour.

lexwhite

This has been a real annoyance for me lately since I run a lot of my music production business out of my website lexwhite.net hosted on Dreamhost and Dreamhost VPS. I love and trust Dreamhost a lot, though, as they have been an exceptionally solid company that I have worked with for, dang, nearly 20 years now I think! All of this new AI stuff has been exposing vulnerabilites at a rate that is hard to keep up with for anyone. We just have to really harden our cybersecurity as much as possible now.