Jason Nickerson — Hosting Industry InsiderTwo decades
inside the web
as it kept rewriting
itself.
I’m Jason, a hosting industry insider with experience across open-source CMS platforms, control panels, cloud infrastructure, and the events that bring the industry together. Today, I focus on building partnerships, programming industry summits, and documenting what is happening across the hosting ecosystem.
- Oct 29, 2026
Betting on Yourself for Three Billion Dollars
Upwind turns down a massive exit to chase a $3.8 billion valuation, proving that some founders still prefer the long game over a quick Datadog payout.
Read article: Betting on Yourself for Three Billion Dollars→ - Oct 29, 2026
Don't Break Your Production Site Just Yet: WordPress 7.2 Beta 2 Is Here
Testing WordPress 7.2 Beta 2 is about more than just checking boxes; it's about ensuring the ecosystem remains stable for the millions of sites relying on it.
Read article: Don't Break Your Production Site Just Yet: WordPress 7.2 Beta 2 Is Here→ - Oct 29, 2026
Burn the Platform to Save the Network
GMO Internet's refusal to pay a $50 million ransom and their decision to decommission a breached platform sets a gutsy new precedent for hosting infrastructure recovery.
Read article: Burn the Platform to Save the Network→
The early 2000s were the good years for tinkerers. Open-source CMS platforms were the closest thing we had to a universal starter kit, and PHP-Nuke and osCommerce were how you learned to ship real projects on the open web. I went deep on Joomla for the better part of a decade, contributing code to the project, organizing its community around releases and events, and eventually crossing over into the WordPress orbit that quietly swallowed everything in its path.
From there the story is a tour of the hosting stack: cPanel and the control-panel era that defined shared hosting, the managed cloud wave at Cloudways and DigitalOcean, and the publishing side at webhosting.today. Day to day now I'm at JetBackup, working on backup and disaster recovery and helping hosts protect the infrastructure that keeps everything running. I also program the seasonal industry summits, Atlas Digital Summit and Domain Days Dubai, where the hosting community gathers to set the agenda for what comes next.
The through-line is community, the conferences, the hallway conversations, and the group chats where the industry actually decides what happens next. The technology changes; the people pointing it in the right direction stay the same.
Twenty-something years,
in reverse.
- 2026 – present
FounderAtlas Digital SummitPrivate gatherings for hosting leaders, AI infrastructure innovators, and the builders of the agentic web.
- 2026 – presentFounderConf64
The Conference Operating System for Business Development and Field Marketing Teams.
- 2026 – present
Co-FounderSuperDeployThe advanced migration engine for AI applications. Seamlessly transition your codebase to independent, production-grade infrastructure in minutes.
- 2025 – 2026Director of Business Developmentwebhosting.today
Contract · Business development and partnerships for the hosting publisher.
- 2024 – presentBusiness Development & Partnerships ManagerJetBackup
Backup and disaster recovery for the hosting ecosystem.
- 2023 – present
Chief Marketing Officer, Founding TeamDomain Days DubaiMENA’s domain and digital asset conference.
- 2021 – 2023Senior Manager, WordPress Business Unit → Lead Community Marketing Manager IICloudways / DigitalOcean
Full-time · WordPress community, field marketing, and sales enablement through the acquisition.
- 2019 – 2021Marketing ManagercPanel
Full-time · Event planner and marketing strategist for 500–3,000 attendee events and virtual series.
- 2017 – 2019FounderCMS Summit
The global CMS conference.
- 2007 – 2019CEO | FounderJoomlaxtc.com / Monev Software LLC
Premium Joomla templates and extensions. 101,000+ members.
- 2015 – 2019Board Member, Capital Team ChairJoomla! Project
Leadership, sponsorships, and partnerships for the open-source CMS.
- 2001 – 2005DeveloperPHP-Nuke · osCommerce era
First shipping code in the early open-source web.
Threat Briefing: PHP2Shell RCE Criticals, DreamHost Breach & CMS Cache Leaks
CORE INFRASTRUCTURE & HOSTING
PHP2Shell Remote Code Execution — Critical engine-level flaws in PHP used for global web server deployments [5], [11].
- CVE / severity: CVE-2026-109618 and CVE-2026-109619 | CVSS 9.2 (Critical)
- Affected versions: Global PHP engine (specific version ranges not disclosed in sources, but impacting standard server deployments) [11].
- Fixed in: Latest security releases (check distribution-specific repositories).
- Action now:
- Execute
dnf update phporapt-get upgrade phpimmediately. - Audit server logs for unusual outbound shell activity originating from the PHP process.
- Execute
DreamHost Infrastructure Breach — Unauthorized access affecting a significant portion of hosting accounts [9].
- CVE / severity: No CVE assigned | High Impact
- Affected versions: Approximately 10% of all FTP, SFTP, and Email accounts hosted on DreamHost infrastructure [9].
- Fixed in: Incident response in progress; impacted accounts isolated.
- Action now:
- Mandatory rotation of all FTP, SFTP, and email passwords for accounts hosted on the platform.
- Review authorized keys files (
~/.ssh/authorized_keys) for unauthorized entries.
Virtualine 'Bulletproof' Provider Takedown — International law enforcement seizure of hosting infrastructure [10].
- CVE / severity: N/A (Infrastructure Seizure)
- Affected versions: Dozens of physical servers and hundreds of virtual servers at Limburg data centers [10].
- Action now: Infrastructure teams should monitor for IP reputation changes if moving workloads from seized IP blocks.
WORDPRESS & CMS ECOSYSTEM
LiteSpeed Cache REST Data Exposure — Persistence of sensitive admin-level data in cache despite purge attempts [14].
- CVE / severity: No CVE assigned | High Severity
- Affected versions: LiteSpeed Cache plugin versions prior to 7.9.1.
- Fixed in: 7.9.1
- Action now:
- Update to version 7.9.1 immediately via
wp plugin update litespeed-cache[14]. - Manually clear object caches and CDN caches as standard cron purges may fail to clear the specific REST data leaked [14].
- Update to version 7.9.1 immediately via
Prime Mover PHP Object Injection — Unauthenticated flaw allowing privilege escalation via malicious backups [8].
- CVE / severity: CVE-2026-115806 | Severity not disclosed in sources (estimated Critical).
- Affected versions: Prime Mover – Backup and Migration (all versions prior to fix) [8].
- Fixed in: Latest available version (check plugin repository).
- Action now:
- Disable unauthenticated backup imports in plugin settings.
- Scan for base64-encoded payloads in database tables related to Prime Mover [8].
Critical Third-Party Plugin Vulnerabilities — Unauthenticated RCE and File Uploads in popular commercial tools [7].
- YOOtheme Pro (CVE-2026-102785): Unauthenticated file upload. CVSS 9.8. Affected: 5.0.0–5.0.52. Fixed in 5.0.53.
- The Grid (CVE-2026-94169): Unauthenticated RCE. CVSS 9.8. Fixed in 2.8.2.
- Avada Fusion Builder (CVE-2026-97670): Unauthenticated arbitrary action invocation. CVSS 9.1. Fixed in 3.16.2.
- MW WP Form (CVE-2026-92086): Sensitive information exposure. Affected: All versions up to latest report [2].
- Action now: Audit all client sites using premium themes/builders and force updates to fixed versions.
On the
road.
Conferences, summits, and WordCamps I’ll be at in the months ahead.
- Nov 11 – 12, 2026
- State of the WordDec 2026
- Mar 15 – 18, 2027
When the servers
go quiet.
A small digital label putting out industrial house, progressive house, and dubstep. A different kind of open protocol.
Twenty years of showing up for the projects, communities, and voices that keep the open web open.
A news portal covering the hosting and domain industry — and a running excuse to keep talking to the people who build it.