Jason Nickerson — Hosting Industry InsiderTwo decades
inside the web
as it kept rewriting
itself.
I’m Jason, a hosting industry insider with experience across open-source CMS platforms, control panels, cloud infrastructure, and the events that bring the industry together. Today, I focus on building partnerships, programming industry summits, and documenting what is happening across the hosting ecosystem.
- Nov 4, 2026
When the Venue Watches You Back
MSG’s use of facial recognition is under fire again, proving that in the age of big data, your face is just another credential—and a liability.
Read article: When the Venue Watches You Back→ - Nov 4, 2026
When the Security Tool Becomes the Skeleton Key
A breach at cPGuard proves that updating your software is only the first step when your root-level credentials have already left the building.
Read article: When the Security Tool Becomes the Skeleton Key→ - Nov 3, 2026
Low-Code AI Training Is the New Managed Hosting
Trajectory's $45M raise suggests we are moving past the 'hacker' phase of AI and into the era where the business suite finally takes the wheel.
Read article: Low-Code AI Training Is the New Managed Hosting→
The early 2000s were the good years for tinkerers. Open-source CMS platforms were the closest thing we had to a universal starter kit, and PHP-Nuke and osCommerce were how you learned to ship real projects on the open web. I went deep on Joomla for the better part of a decade, contributing code to the project, organizing its community around releases and events, and eventually crossing over into the WordPress orbit that quietly swallowed everything in its path.
From there the story is a tour of the hosting stack: cPanel and the control-panel era that defined shared hosting, the managed cloud wave at Cloudways and DigitalOcean, and the publishing side at webhosting.today. Day to day now I'm at JetBackup, working on backup and disaster recovery and helping hosts protect the infrastructure that keeps everything running. I also program the seasonal industry summits, Atlas Digital Summit and Domain Days Dubai, where the hosting community gathers to set the agenda for what comes next.
The through-line is community, the conferences, the hallway conversations, and the group chats where the industry actually decides what happens next. The technology changes; the people pointing it in the right direction stay the same.
Twenty-something years,
in reverse.
- 2026 – present
FounderAtlas Digital SummitPrivate gatherings for hosting leaders, AI infrastructure innovators, and the builders of the agentic web.
- 2026 – presentFounderConf64
The Conference Operating System for Business Development and Field Marketing Teams.
- 2026 – present
Co-FounderSuperDeployThe advanced migration engine for AI applications. Seamlessly transition your codebase to independent, production-grade infrastructure in minutes.
- 2025 – 2026Director of Business Developmentwebhosting.today
Contract · Business development and partnerships for the hosting publisher.
- 2024 – presentBusiness Development & Partnerships ManagerJetBackup
Backup and disaster recovery for the hosting ecosystem.
- 2023 – present
Chief Marketing Officer, Founding TeamDomain Days DubaiMENA’s domain and digital asset conference.
- 2021 – 2023Senior Manager, WordPress Business Unit → Lead Community Marketing Manager IICloudways / DigitalOcean
Full-time · WordPress community, field marketing, and sales enablement through the acquisition.
- 2019 – 2021Marketing ManagercPanel
Full-time · Event planner and marketing strategist for 500–3,000 attendee events and virtual series.
- 2017 – 2019FounderCMS Summit
The global CMS conference.
- 2007 – 2019CEO | FounderJoomlaxtc.com / Monev Software LLC
Premium Joomla templates and extensions. 101,000+ members.
- 2015 – 2019Board Member, Capital Team ChairJoomla! Project
Leadership, sponsorships, and partnerships for the open-source CMS.
- 2001 – 2005DeveloperPHP-Nuke · osCommerce era
First shipping code in the early open-source web.
Threat Briefing: CISA WordPress KEV, cPGuard Supply Chain & Beget Cloud Wipe
🚨 Active Infrastructure & Hosting Threats
-
OpsShield cPGuard Supply Chain Attack — Critical supply chain compromise where attackers pushed malicious updates through OpsShield's infrastructure [13].
- CVE / severity: no CVE assigned / Critical
- Affected versions: cPGuard installations updated within the last 48 hours
- Fixed in: Clean repository mirrors (refer to vendor status)
- Action now: Verify file integrity of
/usr/local/cpguard, check for unauthorized processes, and contact OpsShield support to verify clean update channels [13].
-
Kernel.sh Infrastructure Breach — Multi-stage compromise involving leaked hosting provider credentials and logging provider access [11].
- CVE / severity: no CVE assigned / High
- Affected versions: GPU-enabled infrastructure and KERNEL browser sessions
- Fixed in: Infrastructure lockdown completed Nov 4, 2026
- Action now: Rotate all API keys associated with hosting providers and logging infrastructure immediately [11].
-
Beget Hosting Cloud Data Wipe — Severe destructive attack on a major provider resulting in the total loss of VPS, Kubernetes, and binary backup data [7].
- Impact: Destruction of virtual server binaries; file-level backups remain for potential recovery [7].
- Action now: Hosting admins should verify off-site, immutable backups that are physically and logically separated from their primary cloud provider's API reach.
-
cPanel & WHM Auth Bypass (KeyHunter Operation) — Threat actors are targeting academic and hosting environments using a recent credential flaw [14].
- CVE / severity: CVE-2026-41940 / High
- Affected versions: cPanel & WHM versions prior to patch
- Fixed in: Current cPanel & WHM stable releases
- Action now: Run
/scripts/upcpimmediately to ensure the latest security patches are applied [14].
🛡️ Critical Network & Gateway Security
- WatchGuard AuthPoint Gateway MitM — Improper certificate validation allows attackers to intercept authentication traffic [12].
- CVE / severity: CVE-2026-121638 / 9.1 (Critical)
- Affected versions: AuthPoint Gateway versions < 7.6.0
- Fixed in: Version 7.6.0
- Action now: Upgrade AuthPoint Gateway to version 7.6.0 or higher immediately to prevent Man-in-the-Middle attacks [12].
📝 WordPress & CMS Vulnerabilities
-
WordPress Core RCE (CISA KEV) — CISA has officially added the recent Core RCE flaw to the Known Exploited Vulnerabilities catalog as mass exploitation is confirmed [1, 3, 6].
- CVE / severity: CVE-2026-119977 (also cited as 2026-87902) / 9.8 (Critical)
- Affected versions: WordPress Core < 7.1.4
- Fixed in: WordPress 7.1.4 (and backported security releases)
- Action now: Use
wp core updateto reach 7.1.4; check theme folders andPEARlibraries for unauthorized modifications [2, 6].
-
BuddyPress XProfile Critical File Deletion — A high-severity flaw in a popular community plugin allows unauthenticated attackers to delete arbitrary files [4].
- CVE / severity: CVE-2026-120518 / 9.1 (Critical)
- Affected versions: BuddyPress XProfile Custom Image Field plugin (all versions prior to fix)
- Fixed in: Not disclosed in sources; recommended to deactivate/remove the plugin if unpatched [4].
- Action now: Audit all sites for the XProfile Custom Image Field plugin and apply vendor updates immediately.
-
Uncanny Toolkit for LearnDash Privilege Escalation — Unauthenticated users can gain elevated privileges, potentially compromising LMS environments [5].
- CVE / severity: CVE-2026-65555 / Critical (CVSS 3.1)
- Affected versions: Uncanny Toolkit for LearnDash <= 3.8.2
- Fixed in: Version 3.9.0 (implied)
- Action now:
wp plugin update uncanny-learndash-toolkitto the latest version [5].
On the
road.
Conferences, summits, and WordCamps I’ll be at in the months ahead.
- Nov 11 – 12, 2026
- State of the WordDec 2026
- Mar 15 – 18, 2027
When the servers
go quiet.
A small digital label putting out industrial house, progressive house, and dubstep. A different kind of open protocol.
Twenty years of showing up for the projects, communities, and voices that keep the open web open.
A news portal covering the hosting and domain industry — and a running excuse to keep talking to the people who build it.