hosting

DreamHost: security status

patchedofficial notice · 2026-10-23

Summary

Official status page (Oct 21-23): protections on all platforms (shared, VPS, DreamPress, dedicated) on the morning of Oct 21, official PHP fixes applied across the whole network on Oct 22, and resolved on Oct 23 (11:26 PDT): "PHP's security fix is now installed across all DreamHost servers, including Shared, Dedicated, VPS, and DreamPress." PHP 8.1 and older are covered by fixes from DreamHost's PHP Extended Support program. The notice gives no CVE numbers or fixed version numbers.

Customer action:

If the site runs on DreamCompute (a server you manage), DreamHost's fix does not cover it: update PHP yourself. Otherwise DreamHost says no action is needed for this fix. PHP 8.1 and older are out of upstream support, so plan a move to a supported PHP in the panel.

Source: https://www.dreamhoststatus.com/pages/incident/575f0f606826303142000510/6ad8c218a7031204d4ca2981
Verified: 2026-10-26

Covers shared hosting, DreamPress, managed VPS and dedicated servers, which DreamHost patches. DreamCompute (IaaS, where the customer runs PHP) is in the same network (AS26347) and shows as DreamHost too; DreamHost's notice does not cover it. Temporary sites use example.dreamhosters.com on the same servers.

How this tool recognises the provider

AS numbers: AS26347
Text in the AS name: DREAMHOST
Name servers: *.dreamhost.com

Report a correction (GitHub)