Jason Nickerson — Hosting Industry InsiderTwo decades
inside the web
as it kept rewriting
itself.
I’m Jason, a hosting industry insider with experience across open-source CMS platforms, control panels, cloud infrastructure, and the events that bring the industry together. Today, I focus on building partnerships, programming industry summits, and documenting what is happening across the hosting ecosystem.
- Aug 13, 2026
When Lawyers Debug Security Researchers
Microsoft tried to silence a security researcher with legal threats, but it backfired spectacularly with a fresh zero-day release.
Read article: When Lawyers Debug Security Researchers→ - Aug 13, 2026
The Patch That Can't Wait: WordPress 7.0.4
WordPress 7.0.4 is out to address a critical security vulnerability, making this a mandatory update for anyone managing servers or sites.
Read article: The Patch That Can't Wait: WordPress 7.0.4→ - Aug 13, 2026
A Decade in the Dark: The Image Upload That Stayed Dangerous
WordPress 7.0.4 patches a decade-old vulnerability that turned simple image uploads into server-side execution, reminding us that legacy code is never truly 'done'.
Read article: A Decade in the Dark: The Image Upload That Stayed Dangerous→
The early 2000s were the good years for tinkerers. Open-source CMS platforms were the closest thing we had to a universal starter kit, and PHP-Nuke and osCommerce were how you learned to ship real projects on the open web. I went deep on Joomla for the better part of a decade, contributing code to the project, organizing its community around releases and events, and eventually crossing over into the WordPress orbit that quietly swallowed everything in its path.
From there the story is a tour of the hosting stack: cPanel and the control-panel era that defined shared hosting, the managed cloud wave at Cloudways and DigitalOcean, and the publishing side at webhosting.today. Day to day now I'm at JetBackup, working on backup and disaster recovery and helping hosts protect the infrastructure that keeps everything running. I also program the seasonal industry summits, Atlas Digital Summit and Domain Days Dubai, where the hosting community gathers to set the agenda for what comes next.
The through-line is community, the conferences, the hallway conversations, and the group chats where the industry actually decides what happens next. The technology changes; the people pointing it in the right direction stay the same.
Twenty-something years,
in reverse.
- 2026 – present
FounderAtlas Digital SummitPrivate gatherings for hosting leaders, AI infrastructure innovators, and the builders of the agentic web.
- 2026 – presentFounderConf64
The Conference Operating System for Business Development and Field Marketing Teams.
- 2026 – present
Co-FounderSuperDeployThe advanced migration engine for AI applications. Seamlessly transition your codebase to independent, production-grade infrastructure in minutes.
- 2025 – 2026Director of Business Developmentwebhosting.today
Contract · Business development and partnerships for the hosting publisher.
- 2024 – presentBusiness Development & Partnerships ManagerJetBackup
Backup and disaster recovery for the hosting ecosystem.
- 2023 – present
Chief Marketing Officer, Founding TeamDomain Days DubaiMENA’s domain and digital asset conference.
- 2021 – 2023Senior Manager, WordPress Business Unit → Lead Community Marketing Manager IICloudways / DigitalOcean
Full-time · WordPress community, field marketing, and sales enablement through the acquisition.
- 2019 – 2021Marketing ManagercPanel
Full-time · Event planner and marketing strategist for 500–3,000 attendee events and virtual series.
- 2017 – 2019FounderCMS Summit
The global CMS conference.
- 2007 – 2019CEO | FounderJoomlaxtc.com / Monev Software LLC
Premium Joomla templates and extensions. 101,000+ members.
- 2015 – 2019Board Member, Capital Team ChairJoomla! Project
Leadership, sponsorships, and partnerships for the open-source CMS.
- 2001 – 2005DeveloperPHP-Nuke · osCommerce era
First shipping code in the early open-source web.
Threat Briefing: WordPress 7.0.4 RCE, cPanel Kernel Advisory, & OAuth Bypass
🚨 Critical WordPress Core Update: 7.0.4 RCE
WordPress released version 7.0.4 to address a high-impact authenticated Remote Code Execution (RCE) vulnerability [2][3]. Attackers with Author-level privileges can execute arbitrary code on the underlying server. This update follows reports of active exploitation of older vulnerabilities (CVE-2026-60137/63030) in the wild [7].
- CVE / severity: CVE-2026-65640 (CVSS 8.8 High)
- Affected versions: WordPress Core < 7.0.4
- Fixed in: WordPress 7.0.4
- Action now:
- Run
wp core updateimmediately. - Audit all users with "Author" roles or higher for suspicious activity.
- Run
🛡️ Infrastructure & Hosting: cPanel Linux Kernel Vulnerability
A major advisory has been issued for cPanel & WHM environments regarding an underlying Linux Kernel vulnerability impacting major distributions [14]. The flaw stems from insufficient error handling, potentially allowing for local privilege escalation or container escapes.
- CVE / severity: No CVE assigned in snippet (High Impact)
- Affected versions: All major Linux distributions running cPanel & WHM
- Fixed in: Current kernel security patches provided by OS vendors
- Action now:
- Update server kernels:
dnf update kerneloryum update kernel. - Reboot servers to apply kernel changes or use
kpatch/LiveCareif available. - Run
/scripts/upcpto ensure cPanel binaries are current.
- Update server kernels:
🔑 Plugin Supply Chain & Authentication Bypasses
A critical authentication bypass in the VentraConnect Passwordless Login plugin allows unauthenticated attackers to log in as any user via a manipulated Spotify OAuth callback [1]. Separately, WooCommerce Subscriptions is vulnerable to PHP Object Injection on sites using High-Performance Order Storage (HPOS) [4][6].
- CVE / severity: CVE-2026-18961 (CVSS 8.1); CVE-2026-18391 (CVSS 9.8)
- Affected versions: VentraConnect <= 1.4.3; WooCommerce Subscriptions < 9.1.0
- Fixed in: VentraConnect 1.4.4 (not disclosed, use latest); WooCommerce Subscriptions 9.1.0
- Action now:
- Update VentraConnect via
wp plugin update ventraconnect-social-login. - Update WooCommerce Subscriptions immediately to prevent RCE via unserialization.
- Update VentraConnect via
⚠️ Active Exploitation & Third-Party Risks
- Fanlore Server Breach: Unauthorized access was confirmed on servers hosting Fanlore on August 6, resulting in data exposure [11].
- Giftware Plugin RCE: CVE-2026-15039 allows unauthenticated file uploads (Web Shells) in versions < 4.2.10 [8].
- Malware Campaign: A spoofed CCleaner site is actively distributing multi-stage malware designed to hijack Chrome cookies and authentication tokens [12].
On the
road.
Conferences, summits, and WordCamps I’ll be at in the months ahead.
- Aug 16 – 19, 2026
- Sep 28 – 29, 2026
- Domain Days DubaiRescheduled
New dates to be announced.
Oct 15 – 16, 2026 - Nov 11 – 12, 2026
- State of the WordDec 2026
- Mar 15 – 18, 2027
When the servers
go quiet.
A small digital label putting out industrial house, progressive house, and dubstep. A different kind of open protocol.
Twenty years of showing up for the projects, communities, and voices that keep the open web open.
A news portal covering the hosting and domain industry — and a running excuse to keep talking to the people who build it.