DreamHost confirms data breach exposed FTP logins and webmail sessions
A newly disclosed flaw can hand an attacker the ability to run their own code on systems running interview -- not a minor bug, the kind that gets full control.
Cryptocurrency exchange Binance says North Korean hackers used a fake job interview to trick an employee into installing malware that ultimately let them compromise the company's wallet infrastructure and steal about $6.34 billion in digital assets.
Although Binance said it detected the attack and rotated all related credentials as a precautionary step, the company said information about "Engineer A's role and his related colleagues on our wallet infrastructure team was exposed to the hacker." The second part of the attack occurred in September 2026, with the threat actor contacting another engineer (named "Engineer B") via a legitimate job-hunting platform by disguising themselves as a Project Director.
DreamHost is warning of a data breach after attackers gained access to its File Manager platform for two months and stole customers' FTP/SFTP usernames and passwords.
The Race Against the 3-Day Clock: How Rapid7 Helps Meet BOD 26-04 Compliance The Race Against the 3-Day Clock: How Rapid7 Helps Meet BOD 26-04 Compliance On June 10, 2026, CISA issued Binding Operational Directive 26-04, "Prioritizing Security Updates Based on Risk." Strip away the regulatory language and it reads like a single operational fact: for a vulnerability that is actively exploited, publicly reachable, and grants an attacker full control, you now have three calendar days to remediate it — and you must run a forensic investigation in parallel to determine whether you've already been breached.
The latest launches, best practices, and technical deep-dives curated for startup builders By Khushboo Shah, Director of Acquisition & Customer Experience for AWS Startups | 13 October 2026 AWS Startup Advisor , the AI-powered build assistant that helps startups build and migrate on AWS, is adding new migration paths, cost and credit visibility, and relevant discounts.
These security protections have led to confusion among customers about why they are being advised to change all their stored passwords and authentication if their data was encrypted before being uploaded to the company's servers.
The developers of Goddess of Victory: NIKKE have confirmed that hackers tampered with the game's PC launcher scripts in a supply-chain attack, distributing malware capable of stealing credentials and cryptocurrency wallet data.
Binance’s report states that they soon found out the DevOps engineer “had a container deployment permission token on his computer.” On the day of the theft, the attacker logged into the wallet software engineer’s computer with the credentials stolen from the DevOps engineer, deployed a container and ran a malicious script that launched the attack.
AWS Startup Advisor scans the workspace and produces a structured signal inventory in under a minute, so the recommendation is grounded in what the code actually does rather than what you remember it doing: Detected signals: - Framework: LangGraph + LangChain (single StateGraph 'pro-search-agent', 4 nodes) - Multi-agent: Yes (generate_query -> web_research -> reflection -> loop -> finalize_answer) - Model provider: Google Gemini (langchain-google-genai + google-genai) - External tool: Google Search API (native grounding) - Data stores: Redis 6 + Postgres 16 (LangGraph checkpointer/store) - Frontend: React + Vite - Trigger: request (React UI -> FastAPI/LangGraph backend) AWS Startup Advisor pre-fills what it already detected (framework, multi-agent, model provider) and asks only what it cannot infer.
A deterministic scoring engine first rules out runtimes that will not fit the workload, then ranks what remains on how the agent actually runs (session length, orchestration, traffic shape, ops preference, and existing infrastructure), and records why each was chosen or eliminated: Runtime scores: AgentCore 44 | Lambda MicroVMs 41 | ECS 33 | EKS 28 Eliminated: Lambda Standard (15-min timeout cannot cover 15min-8hr sessions) Recommendation: Amazon Bedrock AgentCore Runtime, framework on runtime (bring the existing LangGraph code, adopt POST /invocations + GET /ping) Model: Claude Sonnet 4.6 (balanced), with a tiered cascade after the migration plan (Claude Haiku 4.5 for query generation and reflection, Claude Sonnet 4.6 for final synthesis) Web search: AgentCore native Web Search replaces Google Search grounding AWS Startup Advisor estimates monthly run cost at the workload's actual token volumes.
What happened
DreamHost is warning of a data breach after attackers gained access to its File Manager platform for two months and stole customers' FTP/SFTP usernames and passwords.
The breach exposed FTP logins and webmail sessions.
What changed
The Race Against the 3-Day Clock: How Rapid7 Helps Meet BOD 26-04 Compliance On June 10, 2026, CISA issued Binding Operational Directive 26-04, "Prioritizing Security Updates Based on Risk." For a vulnerability that is actively exploited, publicly reachable, and grants an attacker full control, organizations now have three calendar days to remediate it, alongside a forensic investigation to determine if they've already been breached.
Who is affected
Customers who used DreamHost's File Manager platform during the breach period are affected.
There is confusion among customers about the necessity to change all stored passwords and authentication if their data was encrypted before being uploaded.
Why it matters
The breach highlights significant vulnerabilities in data security practices.
It raises concerns about the potential for unauthorized access and misuse of sensitive information.
Technical details
The breach involved unauthorized access to sensitive user credentials, which could lead to further exploitation if not addressed promptly.
Response
DreamHost has not yet confirmed the status of the fix or any specific remediation steps following the breach.
What security teams should do
Users are advised to change their passwords and review their account security settings.
DreamHost is likely implementing additional security measures to prevent future breaches.
Attribution
BleepingComputer: DreamHost is warning of a data breach after attackers gained access to its File Manager platform for two months and stole customers' FTP/SFTP usernames and passwords.
BleepingComputer: The developers of Goddess of Victory: NIKKE have confirmed that hackers tampered with the game's PC launcher scripts in a supply-chain attack, distributing malware capable of stealing credentials and cryptocurrency wallet data.
BleepingComputer: mSeven Software is warning current and former mSecure password manager customers to change passwords, reset two-factor authentication, and remove passkeys following a cyberattack in which a hacker reportedly stole an encrypted customer database..
BleepingComputer: Since mid-August 2026, a phishing operation has been harvesting live Google sessions from corporate users.
What to watch next
Watch for new exploitation reports and updated indicators of compromise.
Watch for updated vendor guidance and fixed-version details.