Jason Nickerson — Hosting Industry InsiderTwo decades
inside the web
as it kept rewriting
itself.
I’m Jason, a hosting industry insider with experience across open-source CMS platforms, control panels, cloud infrastructure, and the events that bring the industry together. Today, I focus on building partnerships, programming industry summits, and documenting what is happening across the hosting ecosystem.
- Sep 10, 2026
Your Driver's License Just Joined the Public Domain
Identity verification giant IDScan has confirmed a massive breach affecting 150 million records, proving once again that centralized data is just a shiny target.
Read article: Your Driver's License Just Joined the Public Domain→ - Sep 9, 2026
When AI Agents Start Acting Like Bad Employees
Sequoia's $25 million bet on Cymphony highlights the next major shift in enterprise security: protecting the company from its own autonomous agents.
Read article: When AI Agents Start Acting Like Bad Employees→ - Sep 8, 2026
Space Is Getting Crowded, and That’s Good for Business
Stoke Space just landed a billion-dollar Series E to take on SpaceX, proving that the era of launch monopolies is finally coming to an end.
Read article: Space Is Getting Crowded, and That’s Good for Business→
The early 2000s were the good years for tinkerers. Open-source CMS platforms were the closest thing we had to a universal starter kit, and PHP-Nuke and osCommerce were how you learned to ship real projects on the open web. I went deep on Joomla for the better part of a decade, contributing code to the project, organizing its community around releases and events, and eventually crossing over into the WordPress orbit that quietly swallowed everything in its path.
From there the story is a tour of the hosting stack: cPanel and the control-panel era that defined shared hosting, the managed cloud wave at Cloudways and DigitalOcean, and the publishing side at webhosting.today. Day to day now I'm at JetBackup, working on backup and disaster recovery and helping hosts protect the infrastructure that keeps everything running. I also program the seasonal industry summits, Atlas Digital Summit and Domain Days Dubai, where the hosting community gathers to set the agenda for what comes next.
The through-line is community, the conferences, the hallway conversations, and the group chats where the industry actually decides what happens next. The technology changes; the people pointing it in the right direction stay the same.
Twenty-something years,
in reverse.
- 2026 – present
FounderAtlas Digital SummitPrivate gatherings for hosting leaders, AI infrastructure innovators, and the builders of the agentic web.
- 2026 – presentFounderConf64
The Conference Operating System for Business Development and Field Marketing Teams.
- 2026 – present
Co-FounderSuperDeployThe advanced migration engine for AI applications. Seamlessly transition your codebase to independent, production-grade infrastructure in minutes.
- 2025 – 2026Director of Business Developmentwebhosting.today
Contract · Business development and partnerships for the hosting publisher.
- 2024 – presentBusiness Development & Partnerships ManagerJetBackup
Backup and disaster recovery for the hosting ecosystem.
- 2023 – present
Chief Marketing Officer, Founding TeamDomain Days DubaiMENA’s domain and digital asset conference.
- 2021 – 2023Senior Manager, WordPress Business Unit → Lead Community Marketing Manager IICloudways / DigitalOcean
Full-time · WordPress community, field marketing, and sales enablement through the acquisition.
- 2019 – 2021Marketing ManagercPanel
Full-time · Event planner and marketing strategist for 500–3,000 attendee events and virtual series.
- 2017 – 2019FounderCMS Summit
The global CMS conference.
- 2007 – 2019CEO | FounderJoomlaxtc.com / Monev Software LLC
Premium Joomla templates and extensions. 101,000+ members.
- 2015 – 2019Board Member, Capital Team ChairJoomla! Project
Leadership, sponsorships, and partnerships for the open-source CMS.
- 2001 – 2005DeveloperPHP-Nuke · osCommerce era
First shipping code in the early open-source web.
Threat Briefing: cPanel/WHM RCE, Site Reviews Object Injection & VPN Infrastructure Leak
Infrastructure & Hosting Updates
cPanel & WHM Security Advisory (AV26-908) — Critical vulnerabilities in the cPanel management stack allow for unauthorized server-level actions [14].
- CVE / severity: Not fully disclosed (AV26-908) / High
- Affected versions: cPanel & WHM versions prior to 11.110.0.143
- Fixed in: 11.110.0.143
- Action now: Run
/scripts/upcpor update via the WHM interface to ensure you are on the latest security release.
VPN Infrastructure Leak (Surfshark) — An internal engineering environment was exposed to the public internet due to human error [10]. While customer data remains unaffected, internal credentials or keys exposed during such leaks are often targeted for lateral movement.
- CVE / severity: No CVE assigned / Medium
- Affected versions: Internal engineering infrastructure
- Fixed in: Environment secured as of September 2026
- Action now: Review internal CI/CD pipelines and engineering environments for inadvertent public exposure; rotate API keys if similar leaks are suspected.
WordPress Core & Plugin Vulnerabilities
Site Reviews PHP Object Injection — Unauthenticated attackers can inject arbitrary PHP objects due to insecure deserialization [4][6].
- CVE / severity: CVE-2026-82925 / 9.8 (Critical)
- Affected versions: 7.2.2 through 8.2.2
- Fixed in: 8.3.0
- Action now:
wp plugin update site-reviews. Monitor for IoCs involving malicious magic methods (__wakeup,__destruct) leveraged from other installed plugins/themes.
miniOrange 2FA Arbitrary Option Deletion — A missing authorization vulnerability (CWE-862) allows unauthenticated attackers to delete arbitrary site options [8].
- CVE / severity: CVE-2026-77770 / 7.5 (High)
- Affected versions: Not disclosed in sources
- Fixed in: Patch released; specific version not disclosed in sources
- Action now: Update the miniOrange 2FA plugin immediately to the latest available version via the WordPress dashboard.
UDX Usability Dynamics Stateless Plugin Vulnerability — A new vulnerability has been detected in the cloud storage synchronization plugin [7].
- CVE / severity: CVE-2026-81801 / Severity pending
- Affected versions: Up to and including 4.4.1
- Fixed in: Not disclosed in sources
- Action now: Monitor for updates to the Stateless plugin; consider temporary deactivation if the site handles sensitive cloud storage credentials.
Strategic Defense & Managed Hosting
Automated Zero-Day Mitigation — Managed hosting providers (e.g., Hosted.com) are increasingly moving toward dual-layered security, integrating Monarx (behavioral prevention) with Imunify360 (signature scanning) to catch PHP-based exploits before CVEs are published [9][11]. Agencies should prioritize hosts using runtime protection rather than just static file scanning to defend against the 277+ new vulnerabilities reported this week [1].
On the
road.
Conferences, summits, and WordCamps I’ll be at in the months ahead.
- Aug 16 – 19, 2026
- Sep 28 – 29, 2026
- Domain Days DubaiRescheduled
New dates to be announced.
Oct 15 – 16, 2026 - Nov 11 – 12, 2026
- State of the WordDec 2026
- Mar 15 – 18, 2027
When the servers
go quiet.
A small digital label putting out industrial house, progressive house, and dubstep. A different kind of open protocol.
Twenty years of showing up for the projects, communities, and voices that keep the open web open.
A news portal covering the hosting and domain industry — and a running excuse to keep talking to the people who build it.