Critical vulnerabilities have been found in Apache OFBiz, permitting full remote code execution (RCE) and authentication bypass across all versions released before the recent 24.09.08 patch. Meanwhile, web hosting provider DreamHost disclosed a breach that lasted from August through October 2026, exposing FTP/SFTP credentials, session tokens, and potentially the contents of some email accounts.
Apache OFBiz: Dangerous Flaws Now Fixed
The Apache OFBiz maintainers addressed 46 distinct security defects—two of the most alarming being CVE-2026-68524, which allowed pre-authentication RCE via attacker-controlled screen definitions, and CVE-2026-109928, a password reset flaw that could lead to full account takeover due to flawed authentication algorithm implementation. Other bugs include saved-view authorization bypasses with RCE impact, hard-coded JWT keys granting admin access, and multiple missing authorization weaknesses across modules such as Catalog, Content, Order, Payment, and HR.
All of these issues have been corrected in version 24.09.08 of OFBiz. Users are urged to upgrade immediately. Until then, any user—even view-only or low-privileged accounts—should be considered potentially compromised. Deployments in multitenant setups are particularly risky, as some flaws allow tenant isolation bypass or expose authorization gaps.
DreamHost Breach: Credentials, Emails, and What’s at Risk
DreamHost’s breach stemmed from a vulnerability in its File Manager service (files.dreamhost.com), a browser-based tool used by customers to manage hosted files. From approximately August 2026 through October 23, 2026, attackers exploited that flaw to gather FTP/SFTP credentials of users logging into the File Manager. They also accessed certain webmail systems, obtaining session credentials, with evidence that in limited cases mailbox contents may have been viewed.
The company estimates well under 10% of its approximately 400,000 paying customers were impacted. Notable in the exposure: control panel logins, billing, and payment card details were not accessed, and DreamHost does not store full card numbers. Once the breach was discovered, DreamHost shut down the File Manager service, patched the software, invalidated active sessions, reset passwords for email and FTP/SFTP accounts believed to be affected, and began notifying regulators. Affected users are being offered one year of credit monitoring and identity-theft protection through Equifax.
Advice to users includes changing passwords (especially if reused elsewhere), reviewing email forwarding or filter rules, checking site files for suspicious changes, and treating any alerts from DreamHost as legitimate—since the company clarified it will never request passwords via email links.
On other fronts: AI tools are accelerating the discovery of zero-day vulnerabilities, while network appliances often go more than a year between patches. Cybercriminals are leveraging living-off-the-land tactics, and incidents without encrypted ransom demands—or even direct file encryption—are on the rise.
The overlap between these stories highlights shared lessons: software with visible user actions (like OFBiz screen or view configurations, or DreamHost’s File Manager) can hide serious vulnerabilities. Patch cycles are too slow, and trusted tools are often weak links. Organizations must assume external inputs and “low-privileged” roles are untrusted until proven otherwise. The risk isn’t just what attackers build—it’s what’s already there and neglected.
What this means and what to watch: For developers and system admins, the OFBiz case is a loud warning to audit all open-source tools and their exposed interfaces. For customers of platforms like DreamHost—or any web host—credential hygiene and monitoring for unusual access need to be routine. Regulators and breach disclosure laws will demand more transparency; expect tighter requirements for proving how many were affected and exactly what was accessed. The next breach arguably won’t be a novel attack—it’ll be an old vulnerability left unpatched.
