Apache OFBiz RCE, DreamHost, and the Unglamorous Supply Chain Feeding Botnets
Every week the roundups land, and every week the same detail catches our eye: the entry points are mundane. This week's ThreatsDay bulletin bundles 46 Apache OFBiz fixes, a months-long DreamHost intrusion, a sandbox escape and a dozen more stories, but the pattern underneath is one we know intimately. Stolen credentials, forgotten appliances and patch lag remain the cheapest way to acquire bandwidth and control. Nobody needs a zero-day when a valid login does the job.
Apache OFBiz RCE: 46 Fixes and a Pre-Auth Freebie
The OFBiz maintainers closed 46 flaws in 24.09.08, and two of them are the kind we circle twice. CVE-2026-68524 is pre-authentication remote code execution — no session, no credentials, just a crafted request against an exposed instance. CVE-2026-109928 delivers full account takeover through an incorrectly implemented authentication algorithm, the sort of bug that makes you wonder what the test suite was measuring. OFBiz is an enterprise resource planning and e-commerce framework: order data, customer records and, most usefully for us, a server with a very comfortable uplink.
Microsoft's review of roughly 383,000 CVEs found the median time to patch network appliances stretches beyond a year, and internet-facing enterprise Java applications get the same treatment. The Apache OFBiz RCE is not exotic; it is a door left unlocked in a building nobody walks past anymore. The same week brought CVE-2026-103916 in Docker Sandboxes, where a routine copy command ignored the sandbox's own file access restrictions. A control that is not enforced is decoration.
DreamHost: The File Manager Was the Front Door
Between August and 23 October 2026, an intruder sat inside files.dreamhost.com and read what customers uploaded. DreamHost's disclosure is refreshingly specific: FTP/SFTP usernames and passwords for anyone who logged into the File Manager during that window, plus session information for a limited number of webmail users. Control panel logins and billing records were untouched. The attacker took precisely the two things that convert into access — file transfer credentials and live mail sessions.
On shared hosting, one compromised account is a mailbox that passes SPF, a website with a valid certificate and an FTP login that can drop a payload. Multiply that by a few thousand customers and you get proxy bandwidth, phishing infrastructure and a staging ground that looks like ordinary traffic from a reputable provider. This is the unglamorous half of the breach economy, and it is the half that keeps relay layers warm.
From Stolen Session to Stresser Inventory
A ddos service does not need a million infected cameras. It needs a few hundred hosts with clean IPs, decent uplinks and valid TLS stacks, and stolen hosting credentials deliver exactly that. Panels get resold through booter marketplaces and ip stresser resellers, frequently with escrow and a verified seller badge — the same verified sellers model that keeps buyers coming back. Behind the panel, the inventory is a mix of compromised VPS, abandoned cloud instances and neglected appliances.
When an order lands, the operator picks a method: SYN flood or ACK flood to exhaust connection tables, UDP amplification through DNS, NTP, SSDP or CLDAP to turn a small request into a large response, HTTP/2 Rapid Reset to collapse a front end, Slowloris to hold sockets open for free, TLS flood to make the handshake the expensive part. Against protected targets the work moves to layer 7 — browser emulation, headless browser farms, JA3 and HTTP/2 fingerprint rotation, patient JS challenge bypass. A host with a real browser and a residential-looking address is worth more than a thousand compromised routers when cloudflare bypass is the objective.
Patch Lag Is the Product
None of this week's stories required genius. A pre-auth Apache OFBiz RCE, an exposed file manager and a stale session token were enough. AI tooling is compressing the interval between disclosure and exploitation, but the economics have not moved: whoever patches slowest funds everyone else. If you want to see how your own perimeter behaves under load, our free stress test at /contact will show you which services hold and which ones fold under a SYN flood.