decrypted · 27 october 2026 · ransomware and cybercrime · vulnerabilities and patching · ai and llm security

DreamHost resets email and FTP passwords, and a locked-out customer has to hear about it from someone else

A web host that cannot yet say what happened is a useful case study in who holds the keys to your email. DreamHost, a US provider with more than 400,000 customers in over 100 countries, has spent four days resetting passwords for email and FTP users, and on Monday was still not explaining why.

What DreamHost has said

DreamHost's status page says trouble began on 23 October with File Manager connectivity problems. By that evening the File Manager was offline, some webmail users were signed out, and the company began what it called precautionary password resets, later extended to FTP and SFTP users, the older and the encrypted ways of uploading website files. On 26 October a fix was deployed and the File Manager returned, though resets are still required for a subset of accounts.

BleepingComputer reported that DreamHost had not answered its questions about how many accounts were affected, whether messages or files were exposed, or the cause. Treat any talk of attackers as unconfirmed: the company has not said it was breached.

The door behind the door

The awkward detail is who has to act. Affected mailbox and FTP users cannot log in until the account owner sets a new password and passes it on. DreamHost says it cannot contact those users directly, so owners must reach them by phone, text or other means, possibly after their email has stopped working.

Picture a block of flats where the managing agent changes every lock overnight and posts the new keys only to the landlord. Tenants may be safer, but they are locked out, and the landlord needs a way to reach them that is not the front door.

Customers were also told to check mailboxes for forwarding rules they do not recognise. That is what you check when someone may have been inside, since a quiet rule copying mail elsewhere survives a password change. DreamHost has not said that happened.

What the defender sees

For a small UK business the symptoms would be login failures, webmail signing staff out, and an unexpected email from the host. DreamHost says it will never email asking for your password, so expect phishers to send fake reset messages. Go to the provider panel directly, never through a link.

The Secure by Design lesson

Email is the master key to almost everything else, because forgot-password links land there. A host that keeps your mailboxes, website files and upload credentials together turns one failure into three. Secure by Design asks suppliers to limit that blast radius, to make recovery work without the channel that is down, and to say plainly what happened.

Customers can ask the same of themselves, for the cost of an afternoon: know who owns each supplier account, keep staff mobile numbers somewhere other than email, keep one recovery address with a different provider, and write down who at the host you would phone.

Also this week

Patched is not the same as clean. Sansec, a web-shop security firm, says a criminal group has planted a small script loader in 953 online stores since July 2025, mostly running Magento. The loader checks whether a visitor is a real shopper or a security scanner, and scanners are shown nothing, which is how it survives inspection. Sansec's pointed finding is that patched stores get the loader too: one store on Magento 2.4.7-p10, with no missing core patches, received it on 23 October, but it had earlier shown a rogue admin account and a backdoor. Sansec has not captured the final payload, and SecurityWeek's report does not name UK stores. The lesson for any UK retailer running Magento is that patching closes the door but does not evict anyone already inside. After patching, look for administrator accounts nobody remembers creating, and for loader code in content blocks.

An AI testing tool in the wrong hands. ARTEX is an open-source, AI-driven penetration-testing tool unveiled in July. The Korea JoongAng Daily reported that an official of the Financial Security Institute said an attacker used it against South Korean financial institutions, and that its developer has since said it will go closed-source, citing misuse. Copies already released stay available, so that is a gesture rather than a fix. Separately, BleepingComputer reports that Seoul police arrested a 32-year-old former penetration tester who they say used ARTEX AI in most attacks on more than 90 organisations, taking 8.2 million records. We found that figure in one outlet only, so treat it as the police's claim. The police said that "Even individuals who are not professional hacker organizations can now hack on a large scale". The design lesson is unglamorous: assume anything you expose to the internet is being probed by tireless, cheap automation, and remove the exposure you do not need.

Sources

If any of this raises a question about your own suppliers, get in touch.