DreamHost has brought its File Manager back online after an incident that disrupted several of its services, though some of its customers still can’t get into their email or FTP accounts until someone sets a new password for them.

DreamHost incident

DreamHost is a web hosting provider whose services include shared, VPS, dedicated and WordPress hosting, along with domain registration, email hosting, and cloud computing and storage.

In its latest update, posted on October 26, the hosting provider said its engineers had pushed out a fix and that files.dreamhost.com was working again.

“We are monitoring the situation to ensure that the File Manager is back in a fully operational state,” the company wrote.

Password resets are still required for a subset of email and FTP/SFTP accounts, DreamHost added. Email hosting, webmail and the File Manager remain listed as disrupted on its status page, while the rest of its services are marked as operational.

The company has not said what caused the incident or how many customers are affected.

From a File Manager glitch to password resets

The first sign of trouble came on the afternoon of October 23, when DreamHost’s operations team said it was looking into connectivity problems with the File Manager interface.

A few hours later, the status page described an incident affecting several services. The File Manager was taken offline, and some webmail users were signed out or saw errors when trying to log in.

That evening, the company said the issue also involved FTP/SFTP access and that it had started resetting passwords. Customers were asked to hold off on changing passwords themselves until they received instructions, since any change made before the reset was complete would be overwritten.

DreamHost described the resets as a precaution. Affected users won’t be able to sign in until the owner of their DreamHost account resets their passwords and shares the new credentials with them, the company explained.

The resets were completed on October 24, and by the following evening DreamHost said all affected account owners had been emailed instructions.

Some customers were unhappy with the way DreamHost let them know their passwords had been reset, and with how little the company has explained.

“Just got the email 2 minutes ago basically saying they’d been compromised but acting all innocent like they have no idea what is happening and are just resetting my password for no reason,” a user wrote on Reddit.

“Good to know they’ve contacted at least some people through their secondary accounts. Still nothing to mine (I just re-checked the spam folder), and the email/sftp passwords were nuked on Friday night, almost 48 hours ago now! That’s a heck of a long time to wait before informing people that the server is still working, but that their passwords have been reset,” someone else replied in the same thread.

Other users speculate that this could be connected to PHP vulnerabilities. “20 year customer here. This morning I asked their support chatbot if this is related to the PHP vulnerabilities and it assured me that’s not the case. I’m skeptical,” another customer commented.

The hosting provider has also attached a warning about fraudulent messages to each of its updates.

“DreamHost will never email you asking for your password. If you receive a password reset email you did not request, you can ignore it,” the company concluded.