Active incident at Dreamhost forcing password reset

Reading the tea leaves: given that the outage started with "connectivity issues affecting the File Manager", which was an install of Monsta FTP [1] - a commercial PHP application - I suspect the file manager got popped by one of the recently published PHP vulnerabilities, and users' FTP credentials may have been exfiltrated. [1]: https://www.monstaftp.com/

I got the email about this and realized I’ve been using them for just shy of 20 years. It was one of the original places I hosted things and where I hosted projects for other people. I haven’t actively used it years but migrating the last few things off has never been a priority. This might be the push I need to re-evaluate everything hosted there and shut down or migrate it all.

Dreamhost - gosh that brings back memories…

This has been a real annoyance for me lately since I run a lot of my music production business out of my website lexwhite.net hosted on Dreamhost and Dreamhost VPS. I love and trust Dreamhost a lot, though, as they have been an exceptionally solid company that I have worked with for, dang, nearly 20 years now I think! All of this new AI stuff has been exposing vulnerabilites at a rate that is hard to keep up with for anyone. We just have to really harden our cybersecurity as much as possible now.

Super displeased with DreamHost's handling of this. I have multiple master accounts. One of them got the email around 12pm today (over 48 hours after the incident started) saying... "As a precaution, we have expired the passwords for some email and FTP/SFTP users on your DreamHost account. Their old passwords no longer work, and no new password has been set." But none of those email passwords were actually expired - all were working. This is confusing - did they only expire passwords that were under threat? If a password wasn't expired, should it be trusted? The same email suggests you change all email passwords you control. Another account received no email warning from DreamHost so I assumed it was fine, but 7 hours later it also received the same generic email. My complaints: - sucks that it took them 48 hours to identify the breach - perhaps understandable - but once the breach was identified, how the fuck does it take them over 7 rolling hours to email their customers? That's terrible. - confusing messaging: DreamHost are claiming that passwords are expired, but in testing multiple accounts, all of them are still working. Do I need to rotate these? (I probably will just for safety). I'm a 25+ year DreamHost customer and generally satisfied, but this feels like amateur hour.