Active incident at Dreamhost forcing password reset

Reading the tea leaves: given that the outage started with "connectivity issues affecting the File Manager", which was an install of Monsta FTP [1] - a commercial PHP application - I suspect the file manager got popped by one of the recently published PHP vulnerabilities, and users' FTP credentials may have been exfiltrated.

[1]: https://www.monstaftp.com/

This has been a real annoyance for me lately since I run a lot of my music production business out of my website lexwhite.net hosted on Dreamhost and Dreamhost VPS. I love and trust Dreamhost a lot, though, as they have been an exceptionally solid company that I have worked with for, dang, nearly 20 years now I think! All of this new AI stuff has been exposing vulnerabilites at a rate that is hard to keep up with for anyone. We just have to really harden our cybersecurity as much as possible now.

Dreamhost - gosh that brings back memories…

I migrated all my stuff from dreamhost about 5 years ago, got this email today and felt validated from having made that decision.

Super displeased with DreamHost's handling of this. I have multiple master accounts. One of them got the email around 12pm today (over 48 hours after the incident started) saying...

"As a precaution, we have expired the passwords for some email and FTP/SFTP users on your DreamHost account. Their old passwords no longer work, and no new password has been set."

But none of those email passwords were actually expired - all were working. This is confusing - did they only expire passwords that were under threat? If a password wasn't expired, should it be trusted?

The same email suggests you change all email passwords you control.

Another account received no email warning from DreamHost so I assumed it was fine, but 7 hours later it also received the same generic email.

My complaints:

- sucks that it took them 48 hours to identify the breach - perhaps understandable

- but once the breach was identified, how the fuck does it take them over 7 rolling hours to email their customers? That's terrible.

- confusing messaging: DreamHost are claiming that passwords are expired, but in testing multiple accounts, all of them are still working. Do I need to rotate these? (I probably will just for safety).

I'm a 25+ year DreamHost customer and generally satisfied, but this feels like amateur hour.

What's going on with Dreamhost lately? Is it falling apart?

I used them for entirely too long, and only continued to do so because a classmate in high school used my referral code to sign up for the account that would become his career of selling and managing websites for local churches.

I could not believe what the hell they were charging for a year of hosting with a dedicated ip (which they at the time required if you wanted https, real scumfuck move), so I didn't pay.

I guess I hope they actually deleted my shit because I sure didn't get this email

Ah, I noticed this yesterday, figured it was just me.

Now that's a blast to the past. What's next, Rapidshare.de is having issues?

[flagged]

[flagged]

[flagged]

[flagged]