Jason Nickerson — Hosting Industry InsiderTwo decades
inside the web
as it kept rewriting
itself.
I’m Jason, a hosting industry insider with experience across open-source CMS platforms, control panels, cloud infrastructure, and the events that bring the industry together. Today, I focus on building partnerships, programming industry summits, and documenting what is happening across the hosting ecosystem.
- Aug 28, 2026
When the Regulators Get Regulated by Ransomware
The ATF has joined the growing list of federal agencies dealing with a 'major incident' after a ransomware group claimed to have breached their systems.
Read article: When the Regulators Get Regulated by Ransomware→ - Aug 28, 2026
Open Source is Picking an AI Fight Worth Having
WordPress joins the push for open-weight AI models to ensure the future of the web isn't locked behind a handful of corporate API gates.
Read article: Open Source is Picking an AI Fight Worth Having→ - Aug 28, 2026
When Lightning Strikes Twice in the Same Month
A second major outage at Namecheap highlights the precarious nature of massive shared hosting fleets and the struggle of maintaining stability at scale.
Read article: When Lightning Strikes Twice in the Same Month→
The early 2000s were the good years for tinkerers. Open-source CMS platforms were the closest thing we had to a universal starter kit, and PHP-Nuke and osCommerce were how you learned to ship real projects on the open web. I went deep on Joomla for the better part of a decade, contributing code to the project, organizing its community around releases and events, and eventually crossing over into the WordPress orbit that quietly swallowed everything in its path.
From there the story is a tour of the hosting stack: cPanel and the control-panel era that defined shared hosting, the managed cloud wave at Cloudways and DigitalOcean, and the publishing side at webhosting.today. Day to day now I'm at JetBackup, working on backup and disaster recovery and helping hosts protect the infrastructure that keeps everything running. I also program the seasonal industry summits, Atlas Digital Summit and Domain Days Dubai, where the hosting community gathers to set the agenda for what comes next.
The through-line is community, the conferences, the hallway conversations, and the group chats where the industry actually decides what happens next. The technology changes; the people pointing it in the right direction stay the same.
Twenty-something years,
in reverse.
- 2026 – present
FounderAtlas Digital SummitPrivate gatherings for hosting leaders, AI infrastructure innovators, and the builders of the agentic web.
- 2026 – presentFounderConf64
The Conference Operating System for Business Development and Field Marketing Teams.
- 2026 – present
Co-FounderSuperDeployThe advanced migration engine for AI applications. Seamlessly transition your codebase to independent, production-grade infrastructure in minutes.
- 2025 – 2026Director of Business Developmentwebhosting.today
Contract · Business development and partnerships for the hosting publisher.
- 2024 – presentBusiness Development & Partnerships ManagerJetBackup
Backup and disaster recovery for the hosting ecosystem.
- 2023 – present
Chief Marketing Officer, Founding TeamDomain Days DubaiMENA’s domain and digital asset conference.
- 2021 – 2023Senior Manager, WordPress Business Unit → Lead Community Marketing Manager IICloudways / DigitalOcean
Full-time · WordPress community, field marketing, and sales enablement through the acquisition.
- 2019 – 2021Marketing ManagercPanel
Full-time · Event planner and marketing strategist for 500–3,000 attendee events and virtual series.
- 2017 – 2019FounderCMS Summit
The global CMS conference.
- 2007 – 2019CEO | FounderJoomlaxtc.com / Monev Software LLC
Premium Joomla templates and extensions. 101,000+ members.
- 2015 – 2019Board Member, Capital Team ChairJoomla! Project
Leadership, sponsorships, and partnerships for the open-source CMS.
- 2001 – 2005DeveloperPHP-Nuke · osCommerce era
First shipping code in the early open-source web.
Threat Briefing: WordPress 7.0.4 RCE, cPanel Root Escalation & Gitea Server Exploits
🚨 Infrastructure & Hosting Alerts
cPanel/WHM Authenticated Root Code Execution — A critical privilege escalation vulnerability allows low-privileged users to gain full root-level control over the hosting server [13][14].
- CVE / severity: Not disclosed in sources / Critical
- Affected versions: Not disclosed in sources
- Fixed in: Current versions (patch available)
- Action now: Run
/scripts/upcpor/usr/local/cpanel/scripts/upcpimmediately to update to the latest stable release; audit low-privileged accounts for suspicious activity [13][14].
Gitea Server Code Injection (Active Exploitation) — CISA warns of active attacks targeting Gitea servers for cryptocurrency mining. Providers are reporting high CPU usage (70%+) on affected virtual servers [12].
- CVE / severity: Not disclosed in sources / Critical
- Affected versions: Not disclosed in sources
- Fixed in: Latest Gitea releases
- Action now: Upgrade Gitea binary/container immediately; monitor server resources for unauthorized mining processes; review outbound connections for mining pools [12].
NetNut Domain Takedown — The homepage of proxy provider NetNut has been seized by the FBI and IRS Criminal Investigation. Infrastructure teams should review any internal dependencies on this provider [10].
🛡️ WordPress Core & Plugin Vulnerabilities
WordPress Core Remote Code Execution (RCE) — Version 7.0.4 addresses a critical flaw where malicious PostScript uploads can lead to RCE during server-side processing [1].
- CVE / severity: CVE-2026-65640 / Critical
- Affected versions: WordPress Core < 7.0.4
- Fixed in: 7.0.4
- Action now: Run
wp core updatevia WP-CLI or update through the dashboard. Ensure Ghostscript/PostScript processing is disabled or restricted on the server level [1].
Hash Form: Unauthenticated PHP Object Injection — A critical deserialization flaw allows remote attackers to execute code without authentication [9].
- CVE / severity: CVE-2026-78292 / 9.8 (Critical)
- Affected versions: ≤ 1.4.1
- Fixed in: Not disclosed in sources; recommended to deactivate/remove the plugin until verified [9].
- Action now:
wp plugin deactivate hash-form --uninstalland check for suspicious files inwp-content/uploads[9].
ACPT (Pro) & Total Donations: Unauthenticated Privilege Escalation — Two critical plugin flaws allow unauthenticated visitors to escalate privileges, potentially to the Administrator level [4][7].
- CVE / severity: CVE-2026-32566 (ACPT) / CVE-2026-78570 (Total Donations)
- Affected versions: ACPT ≤ 2.0.63; Total Donations (all versions impacted)
- Fixed in: ACPT > 2.0.63
- Action now: Update ACPT immediately via
wp plugin update acpt-pro. Total Donations is reported as abandoned; providers should immediately uninstall it from client environments [4][7].
🔍 Threat Intelligence Insights
- AI-Generated Exploits: New research indicates AI agents (Wordfence Argus) are now identifying complex vulnerabilities that previously exceeded human research capabilities, suggesting a shift toward AI-driven "forever-day" vulnerability discovery [2][3].
- Volume Metrics: Wordfence Intelligence reported 240 new vulnerabilities across 184 plugins and 17 themes in the most recent weekly cycle, emphasizing the high-frequency risk to shared hosting environments [5].
On the
road.
Conferences, summits, and WordCamps I’ll be at in the months ahead.
- Aug 16 – 19, 2026
- Sep 28 – 29, 2026
- Domain Days DubaiRescheduled
New dates to be announced.
Oct 15 – 16, 2026 - Nov 11 – 12, 2026
- State of the WordDec 2026
- Mar 15 – 18, 2027
When the servers
go quiet.
A small digital label putting out industrial house, progressive house, and dubstep. A different kind of open protocol.
Twenty years of showing up for the projects, communities, and voices that keep the open web open.
A news portal covering the hosting and domain industry — and a running excuse to keep talking to the people who build it.