Jason Nickerson — Hosting Industry InsiderTwo decades
inside the web
as it kept rewriting
itself.
I’m Jason, a hosting industry insider with experience across open-source CMS platforms, control panels, cloud infrastructure, and the events that bring the industry together. Today, I focus on building partnerships, programming industry summits, and documenting what is happening across the hosting ecosystem.
- Sep 29, 2026
Apologies Won’t Patch a Broken Bot
OpenAI's latest 'oops' moment in Australia highlights a growing gap between AI ambition and the practical realities of digital sovereignty.
Read article: Apologies Won’t Patch a Broken Bot→ - Sep 28, 2026
Billion Dollar Agents and the Cloud Real Estate Problem
Instinct just closed a massive $1 billion Series C, proving that the market's appetite for AI agents is currently bottomless, even if the business model is still rendering.
Read article: Billion Dollar Agents and the Cloud Real Estate Problem→ - Sep 27, 2026
Metabolic testing is losing the Bane mask and gaining a UI
PNOĒ is moving metabolic testing out of the clinical lab and into the gym floor with a self-serve mask that does not require a Ph.D. to operate.
Read article: Metabolic testing is losing the Bane mask and gaining a UI→
The early 2000s were the good years for tinkerers. Open-source CMS platforms were the closest thing we had to a universal starter kit, and PHP-Nuke and osCommerce were how you learned to ship real projects on the open web. I went deep on Joomla for the better part of a decade, contributing code to the project, organizing its community around releases and events, and eventually crossing over into the WordPress orbit that quietly swallowed everything in its path.
From there the story is a tour of the hosting stack: cPanel and the control-panel era that defined shared hosting, the managed cloud wave at Cloudways and DigitalOcean, and the publishing side at webhosting.today. Day to day now I'm at JetBackup, working on backup and disaster recovery and helping hosts protect the infrastructure that keeps everything running. I also program the seasonal industry summits, Atlas Digital Summit and Domain Days Dubai, where the hosting community gathers to set the agenda for what comes next.
The through-line is community, the conferences, the hallway conversations, and the group chats where the industry actually decides what happens next. The technology changes; the people pointing it in the right direction stay the same.
Twenty-something years,
in reverse.
- 2026 – present
FounderAtlas Digital SummitPrivate gatherings for hosting leaders, AI infrastructure innovators, and the builders of the agentic web.
- 2026 – presentFounderConf64
The Conference Operating System for Business Development and Field Marketing Teams.
- 2026 – present
Co-FounderSuperDeployThe advanced migration engine for AI applications. Seamlessly transition your codebase to independent, production-grade infrastructure in minutes.
- 2025 – 2026Director of Business Developmentwebhosting.today
Contract · Business development and partnerships for the hosting publisher.
- 2024 – presentBusiness Development & Partnerships ManagerJetBackup
Backup and disaster recovery for the hosting ecosystem.
- 2023 – present
Chief Marketing Officer, Founding TeamDomain Days DubaiMENA’s domain and digital asset conference.
- 2021 – 2023Senior Manager, WordPress Business Unit → Lead Community Marketing Manager IICloudways / DigitalOcean
Full-time · WordPress community, field marketing, and sales enablement through the acquisition.
- 2019 – 2021Marketing ManagercPanel
Full-time · Event planner and marketing strategist for 500–3,000 attendee events and virtual series.
- 2017 – 2019FounderCMS Summit
The global CMS conference.
- 2007 – 2019CEO | FounderJoomlaxtc.com / Monev Software LLC
Premium Joomla templates and extensions. 101,000+ members.
- 2015 – 2019Board Member, Capital Team ChairJoomla! Project
Leadership, sponsorships, and partnerships for the open-source CMS.
- 2001 – 2005DeveloperPHP-Nuke · osCommerce era
First shipping code in the early open-source web.
Threat Briefing: cPanel Critical Patch, Kiteworks Server Alert & WP Path Traversal RCE
SERVER & INFRASTRUCTURE UPDATES
cPanel & WHM Security Patch — Critical vulnerability response for Linux hosting environments.
- CVE / severity: Not disclosed (up to Critical) [6], [12]
- Affected versions: cPanel & WHM versions prior to September 29, 2026 release [6]
- Fixed in: Patch released September 29, 2026 [6]
- Action now: Run
/scripts/upcpimmediately to apply the latest security updates; monitor official cPanel security advisories for specific CVE identifiers as they are released today [6], [12].
Kiteworks Advanced Forms — Imminent cyberattack threat targeting secure file transfer infrastructure.
- CVE / severity: Not disclosed in sources; High/Critical threat level [9]
- Affected versions: Kiteworks servers utilizing Advanced Forms [9]
- Fixed in: Advisory lifted Sept 27 after emergency mitigation [10]
- Action now: If not already performed, ensure all Kiteworks instances are updated to the latest vendor-supplied firmware; review system logs for unauthorized access attempts following the federal threat intelligence alert [9], [10].
Oracle PeopleSoft Server — Exploitation leading to major data exfiltration.
- CVE / severity: Not disclosed (Active Exploitation) [8]
- Affected versions: Not disclosed in sources [8]
- Fixed in: Not disclosed in sources [8]
- Action now: Audit all Oracle PeopleSoft internet-facing instances; apply all pending security patches and restrict network access to sensitive HR portals [8].
WORDPRESS & CMS VULNERABILITIES
WordPress Core Path Traversal to RCE — Critical bug allowing unauthenticated code execution via double-encoded path traversal.
- CVE / severity: CVE-2026-87902 / Critical [3], [4]
- Affected versions: WordPress core prior to 7.1.2 [3]
- Fixed in: WordPress 7.1.2 (and 7.1.1 for partial mitigations) [1], [3]
- Action now: Force update WordPress core to 7.1.2 (
wp core update); check web server logs for%252e%252e(double-encoded dot-dot-slash) which indicates active probing for this flaw [3], [4].
WordPress Groups Plugin — High-priority privilege escalation allowing subscribers to gain elevated access.
- CVE / severity: Not disclosed / High priority [14]
- Affected versions: Groups plugin <= 4.6.0 [14]
- Fixed in: Not disclosed in sources (Mitigate with Patchstack) [14]
- Action now: Update the Groups plugin to the latest version immediately; if no update is available, restrict Subscriber-level registrations [14].
WordPress File Manager Plugin — Unauthenticated exposure of database backups.
- CVE / severity: Not disclosed / Medium priority [13]
- Affected versions: Version 7.2.2 through 8.0.4 [13]
- Fixed in: Not disclosed in sources (Mitigate with Patchstack) [13]
- Action now: Remove or update the File Manager plugin; audit the
/wp-content/directory for stray.sqlor.zipbackup files that may have been exposed [13].
WordPress Core (Legacy) — Missing permission enforcement in older versions.
- CVE / severity: Not disclosed / Critical [2]
- Affected versions: WordPress versions up to and including 4.8.6 [2]
- Fixed in: Modern WordPress 7.x branches [1]
- Action now: Upgrade legacy sites to the current stable branch (7.1.2) immediately, as these versions lack modern permission checks [2].
On the
road.
Conferences, summits, and WordCamps I’ll be at in the months ahead.
- Aug 16 – 19, 2026
- Sep 28 – 29, 2026
- Domain Days DubaiRescheduled
New dates to be announced.
Oct 15 – 16, 2026 - Nov 11 – 12, 2026
- State of the WordDec 2026
- Mar 15 – 18, 2027
When the servers
go quiet.
A small digital label putting out industrial house, progressive house, and dubstep. A different kind of open protocol.
Twenty years of showing up for the projects, communities, and voices that keep the open web open.
A news portal covering the hosting and domain industry — and a running excuse to keep talking to the people who build it.