Jason Nickerson — Hosting Industry InsiderTwo decades
inside the web
as it kept rewriting
itself.
I’m Jason, a hosting industry insider with experience across open-source CMS platforms, control panels, cloud infrastructure, and the events that bring the industry together. Today, I focus on building partnerships, programming industry summits, and documenting what is happening across the hosting ecosystem.
- Aug 30, 2026
LLMs and the Napster Moment for Music Labels
Sony and Warner are taking Anthropic to court, claiming AI training is just piracy with a fancy interface. It's a high-stakes battle over who owns the data behind the model.
Read article: LLMs and the Napster Moment for Music Labels→ - Aug 29, 2026
Buying the Recipe, Giving Away the Cookies
Silicon Valley's current obsession with open-weight AI isn't charity; it is a calculated land grab for ecosystem dominance and high-value exits.
Read article: Buying the Recipe, Giving Away the Cookies→ - Aug 29, 2026
When Shared Hosting Gets a Little Too Shared
A routine domain parking feature in cPanel recently became a potential back door for root access, proving that even the most mundane tools require constant vigilance.
Read article: When Shared Hosting Gets a Little Too Shared→
The early 2000s were the good years for tinkerers. Open-source CMS platforms were the closest thing we had to a universal starter kit, and PHP-Nuke and osCommerce were how you learned to ship real projects on the open web. I went deep on Joomla for the better part of a decade, contributing code to the project, organizing its community around releases and events, and eventually crossing over into the WordPress orbit that quietly swallowed everything in its path.
From there the story is a tour of the hosting stack: cPanel and the control-panel era that defined shared hosting, the managed cloud wave at Cloudways and DigitalOcean, and the publishing side at webhosting.today. Day to day now I'm at JetBackup, working on backup and disaster recovery and helping hosts protect the infrastructure that keeps everything running. I also program the seasonal industry summits, Atlas Digital Summit and Domain Days Dubai, where the hosting community gathers to set the agenda for what comes next.
The through-line is community, the conferences, the hallway conversations, and the group chats where the industry actually decides what happens next. The technology changes; the people pointing it in the right direction stay the same.
Twenty-something years,
in reverse.
- 2026 – present
FounderAtlas Digital SummitPrivate gatherings for hosting leaders, AI infrastructure innovators, and the builders of the agentic web.
- 2026 – presentFounderConf64
The Conference Operating System for Business Development and Field Marketing Teams.
- 2026 – present
Co-FounderSuperDeployThe advanced migration engine for AI applications. Seamlessly transition your codebase to independent, production-grade infrastructure in minutes.
- 2025 – 2026Director of Business Developmentwebhosting.today
Contract · Business development and partnerships for the hosting publisher.
- 2024 – presentBusiness Development & Partnerships ManagerJetBackup
Backup and disaster recovery for the hosting ecosystem.
- 2023 – present
Chief Marketing Officer, Founding TeamDomain Days DubaiMENA’s domain and digital asset conference.
- 2021 – 2023Senior Manager, WordPress Business Unit → Lead Community Marketing Manager IICloudways / DigitalOcean
Full-time · WordPress community, field marketing, and sales enablement through the acquisition.
- 2019 – 2021Marketing ManagercPanel
Full-time · Event planner and marketing strategist for 500–3,000 attendee events and virtual series.
- 2017 – 2019FounderCMS Summit
The global CMS conference.
- 2007 – 2019CEO | FounderJoomlaxtc.com / Monev Software LLC
Premium Joomla templates and extensions. 101,000+ members.
- 2015 – 2019Board Member, Capital Team ChairJoomla! Project
Leadership, sponsorships, and partnerships for the open-source CMS.
- 2001 – 2005DeveloperPHP-Nuke · osCommerce era
First shipping code in the early open-source web.
Threat Briefing: cPanel Root Escalation & Critical WP Auth Bypass (CVE-2026-76548)
1. Infrastructure & Hosting: cPanel Root Privilege Escalation
A critical vulnerability has been disclosed and patched in cPanel & WHM regarding the domain parking functionality. This flaw allows an authenticated user to create arbitrary files on the filesystem, which can be leveraged to gain full root-level access to the server [8][9].
- Headline — Root Escalation via Domain Parking
- CVE / severity — CVE-2026-65643 / Critical (CVSS not disclosed in sources)
- Affected versions — cPanel & WHM versions prior to 118.0.25, 120.0.12, and 122.0.3 [8]
- Fixed in — 118.0.25, 120.0.12, 122.0.3 [8]
- Action now — Run
/scripts/upcpimmediately to ensure the latest security tier is installed; verify that domain parking features are restricted to trusted users until patched.
2. WordPress: Critical Authentication Bypass in Profile Builder
A high-severity authentication bypass has been identified in the User Profile Builder plugin. Attackers can bypass security checks to gain unauthorized access to user accounts, potentially leading to full site takeover if administrative accounts are targeted [3].
- Headline — User Profile Builder Authentication Bypass
- CVE / severity — CVE-2026-76548 / 9.8 (Critical)
- Affected versions — All versions prior to 4.0 [3]
- Fixed in — Version 4.0
- Action now —
wp plugin update profile-builder; audit user logs for unexpected administrative logins or profile changes.
3. WordPress: Multi-Plugin RCE and Account Takeover Vulnerabilities
Security researchers have disclosed a batch of critical flaws across several high-profile plugins and themes. These include vulnerabilities that enable Remote Code Execution (RCE) and account takeover in tools used for site management, translation, and donations [1][2].
- Headline — Critical Flaws in WPMU DEV, Avada, and TranslatePress
- CVE / severity — Multiple CVEs (including RCE and Auth Bypass) / Critical [1]
- Affected versions — WPMU DEV Dashboard, Avada Theme/Builder, TranslatePress, Pods, and GiveWP (specific version ranges not disclosed in sources) [1][2]
- Fixed in — Latest stable versions available as of 2026-08-29
- Action now — Update all listed plugins and themes to their latest versions; monitor for suspicious PHP execution in
/wp-content/uploads/.
4. Supply Chain & Phishing: Financial Services Targeting
Infrastructure teams should note a spike in targeted phishing infrastructure mimicking banking "vaults." These domains share registrars and are currently bypassing several major reputation filters [11][12].
- Indicators of Compromise —
thecapitalixvault.com,citizenscommunityvault.com[11][12] - Action now — Block these domains at the DNS/Firewall level; update mail server filters to flag domains registered via "Hosting Concepts" containing "vault" keywords.
On the
road.
Conferences, summits, and WordCamps I’ll be at in the months ahead.
- Aug 16 – 19, 2026
- Sep 28 – 29, 2026
- Domain Days DubaiRescheduled
New dates to be announced.
Oct 15 – 16, 2026 - Nov 11 – 12, 2026
- State of the WordDec 2026
- Mar 15 – 18, 2027
When the servers
go quiet.
A small digital label putting out industrial house, progressive house, and dubstep. A different kind of open protocol.
Twenty years of showing up for the projects, communities, and voices that keep the open web open.
A news portal covering the hosting and domain industry — and a running excuse to keep talking to the people who build it.