Jason Nickerson — Hosting Industry InsiderTwo decades
inside the web
as it kept rewriting
itself.
I’m Jason, a hosting industry insider with experience across open-source CMS platforms, control panels, cloud infrastructure, and the events that bring the industry together. Today, I focus on building partnerships, programming industry summits, and documenting what is happening across the hosting ecosystem.
- Sep 2, 2026
When the AI starts picking locks
OpenAI is preparing to release Astra, a model with a specialized talent for finding vulnerabilities, forcing the hosting industry to rethink its defensive perimeter.
Read article: When the AI starts picking locks→ - Sep 2, 2026
Security by Obscurity in the Patch Notes
When five million sites face a high-severity vulnerability, labeling the fix as a minor text update isn't just a mistake—it is a massive failure in communication.
Read article: Security by Obscurity in the Patch Notes→ - Sep 1, 2026
Supply Chain Vulnerability isn't Just About Code
When the backbone of medical distribution goes offline, the industry realizes how thin the line is between digital security and physical health.
Read article: Supply Chain Vulnerability isn't Just About Code→
The early 2000s were the good years for tinkerers. Open-source CMS platforms were the closest thing we had to a universal starter kit, and PHP-Nuke and osCommerce were how you learned to ship real projects on the open web. I went deep on Joomla for the better part of a decade, contributing code to the project, organizing its community around releases and events, and eventually crossing over into the WordPress orbit that quietly swallowed everything in its path.
From there the story is a tour of the hosting stack: cPanel and the control-panel era that defined shared hosting, the managed cloud wave at Cloudways and DigitalOcean, and the publishing side at webhosting.today. Day to day now I'm at JetBackup, working on backup and disaster recovery and helping hosts protect the infrastructure that keeps everything running. I also program the seasonal industry summits, Atlas Digital Summit and Domain Days Dubai, where the hosting community gathers to set the agenda for what comes next.
The through-line is community, the conferences, the hallway conversations, and the group chats where the industry actually decides what happens next. The technology changes; the people pointing it in the right direction stay the same.
Twenty-something years,
in reverse.
- 2026 – present
FounderAtlas Digital SummitPrivate gatherings for hosting leaders, AI infrastructure innovators, and the builders of the agentic web.
- 2026 – presentFounderConf64
The Conference Operating System for Business Development and Field Marketing Teams.
- 2026 – present
Co-FounderSuperDeployThe advanced migration engine for AI applications. Seamlessly transition your codebase to independent, production-grade infrastructure in minutes.
- 2025 – 2026Director of Business Developmentwebhosting.today
Contract · Business development and partnerships for the hosting publisher.
- 2024 – presentBusiness Development & Partnerships ManagerJetBackup
Backup and disaster recovery for the hosting ecosystem.
- 2023 – present
Chief Marketing Officer, Founding TeamDomain Days DubaiMENA’s domain and digital asset conference.
- 2021 – 2023Senior Manager, WordPress Business Unit → Lead Community Marketing Manager IICloudways / DigitalOcean
Full-time · WordPress community, field marketing, and sales enablement through the acquisition.
- 2019 – 2021Marketing ManagercPanel
Full-time · Event planner and marketing strategist for 500–3,000 attendee events and virtual series.
- 2017 – 2019FounderCMS Summit
The global CMS conference.
- 2007 – 2019CEO | FounderJoomlaxtc.com / Monev Software LLC
Premium Joomla templates and extensions. 101,000+ members.
- 2015 – 2019Board Member, Capital Team ChairJoomla! Project
Leadership, sponsorships, and partnerships for the open-source CMS.
- 2001 – 2005DeveloperPHP-Nuke · osCommerce era
First shipping code in the early open-source web.
Threat Briefing: All-in-One WP SQLi, cPanel Root Domain Flaw & Gravity Forms RCE
1. Hosting & Infrastructure: cPanel Root Escalation via Domain Parking
Recent disclosures confirm a critical vulnerability in the domain parking functionality of cPanel & WHM. Attackers with local user access can exploit this flaw to escalate privileges to root, potentially compromising the entire hosting node [9].
- Headline: cPanel Domain Parking Root Privilege Escalation
- CVE / Severity: CVE-2026-65643 / Critical (CVSS not disclosed in sources)
- Affected versions: cPanel & WHM versions prior to August 27, 2026, releases
- Fixed in: Current stable releases (targeted patches applied 2026-08-27) [9]
- Action now:
- Execute
/scripts/upcpto ensure the installation is on the latest patched version. - Audit recently parked domains for suspicious configuration entries.
- Review system logs for unauthorized
rootaccess originating from local accounts.
- Execute
2. Critical WordPress Plugin Vulnerabilities (SQLi & RCE)
A massive-scale vulnerability has been identified in the All-in-One WP Migration plugin, affecting over 5 million sites. The flaw allows unauthenticated SQL injection via archive processing [1]. Additionally, a critical RCE vector has emerged in Gravity Forms via file upload confusion [14].
-
Headline: All-in-One WP Migration SQL Injection (5M+ Sites)
-
CVE / Severity: No CVE assigned / High (CVSS not disclosed in sources) [1]
-
Affected versions: All-in-One WP Migration and Backup <= 7.82
-
Fixed in: 7.83 (or latest available version)
-
Action now:
wp plugin update all-in-one-wp-migrationimmediately; check database for unauthorized admin users. -
Headline: Gravity Forms Unauthenticated Arbitrary File Upload
-
CVE / Severity: No CVE assigned / Critical [14]
-
Affected versions: Gravity Forms <= 3.0.2
-
Fixed in: 3.0.3 (or latest available version)
-
Action now: Update Gravity Forms immediately; scan
/wp-content/uploads/for unexpected PHP files or hashed chunk remnants.
3. CMS Security: Unauthorized Access & XSS
Infrastructure teams should note active exploitation of REST endpoints in medical/clinic management plugins and widespread XSS in popular page builders [2][13].
-
KiviCare (Clinic Management): Unauthenticated data disclosure via REST API endpoints.
- CVE / Severity: CVE-2026-13611 / High [2]
- Fixed in: 4.5.5
- Action now: Block unauthenticated access to
/wp-json/kivicare/v1/via WAF rules if update cannot be applied.
-
WPBakery Page Builder: Stored XSS via the
dataparameter.- CVE / Severity: No CVE assigned / Medium [13]
- Affected versions: <= 8.7.4
- Action now: Update plugin to latest version; restrict subscriber-level access to builder functions.
4. Data Breaches & Infrastructure Incidents
- Aesto Health Breach: A major exfiltration event impacted 9.5 million individuals. The incident involved PII/PHI theft between December and May, only recently concluded in investigation [6]. Hosting providers in the healthcare space should re-verify PII encryption at rest.
- Government Website Defacement: The 8th Circuit Solicitor's Office website was taken offline following "unauthorized activity" and the discovery of malicious code. Investigation by SLED is ongoing [8].
On the
road.
Conferences, summits, and WordCamps I’ll be at in the months ahead.
- Aug 16 – 19, 2026
- Sep 28 – 29, 2026
- Domain Days DubaiRescheduled
New dates to be announced.
Oct 15 – 16, 2026 - Nov 11 – 12, 2026
- State of the WordDec 2026
- Mar 15 – 18, 2027
When the servers
go quiet.
A small digital label putting out industrial house, progressive house, and dubstep. A different kind of open protocol.
Twenty years of showing up for the projects, communities, and voices that keep the open web open.
A news portal covering the hosting and domain industry — and a running excuse to keep talking to the people who build it.