Jason Nickerson — Hosting Industry InsiderTwo decades
inside the web
as it kept rewriting
itself.
I’m Jason, a hosting industry insider with experience across open-source CMS platforms, control panels, cloud infrastructure, and the events that bring the industry together. Today, I focus on building partnerships, programming industry summits, and documenting what is happening across the hosting ecosystem.
- Oct 22, 2026
Hardware Is Hard, But Ambient AI Is Just Getting Weird
Nirva just pulled in $33M for a wearable AI pendant that promises to only listen to you, but history suggests the real challenge is surviving the second iteration.
Read article: Hardware Is Hard, But Ambient AI Is Just Getting Weird→ - Oct 22, 2026
Drop Everything and Patch Your PHP
A critical PHP security update just dropped, and while your host might be on it, you shouldn't wait around to find out. Here is why this cycle matters more than the usual maintenance.
Read article: Drop Everything and Patch Your PHP→ - Oct 22, 2026
Australia’s Domain Cleanup Hits a Grandfather Clock
AUDA is proposing to tighten domain allocation rules while exempting 3.5 million current users, a classic move to avoid a massive registrant revolt.
Read article: Australia’s Domain Cleanup Hits a Grandfather Clock→
The early 2000s were the good years for tinkerers. Open-source CMS platforms were the closest thing we had to a universal starter kit, and PHP-Nuke and osCommerce were how you learned to ship real projects on the open web. I went deep on Joomla for the better part of a decade, contributing code to the project, organizing its community around releases and events, and eventually crossing over into the WordPress orbit that quietly swallowed everything in its path.
From there the story is a tour of the hosting stack: cPanel and the control-panel era that defined shared hosting, the managed cloud wave at Cloudways and DigitalOcean, and the publishing side at webhosting.today. Day to day now I'm at JetBackup, working on backup and disaster recovery and helping hosts protect the infrastructure that keeps everything running. I also program the seasonal industry summits, Atlas Digital Summit and Domain Days Dubai, where the hosting community gathers to set the agenda for what comes next.
The through-line is community, the conferences, the hallway conversations, and the group chats where the industry actually decides what happens next. The technology changes; the people pointing it in the right direction stay the same.
Twenty-something years,
in reverse.
- 2026 – present
FounderAtlas Digital SummitPrivate gatherings for hosting leaders, AI infrastructure innovators, and the builders of the agentic web.
- 2026 – presentFounderConf64
The Conference Operating System for Business Development and Field Marketing Teams.
- 2026 – present
Co-FounderSuperDeployThe advanced migration engine for AI applications. Seamlessly transition your codebase to independent, production-grade infrastructure in minutes.
- 2025 – 2026Director of Business Developmentwebhosting.today
Contract · Business development and partnerships for the hosting publisher.
- 2024 – presentBusiness Development & Partnerships ManagerJetBackup
Backup and disaster recovery for the hosting ecosystem.
- 2023 – present
Chief Marketing Officer, Founding TeamDomain Days DubaiMENA’s domain and digital asset conference.
- 2021 – 2023Senior Manager, WordPress Business Unit → Lead Community Marketing Manager IICloudways / DigitalOcean
Full-time · WordPress community, field marketing, and sales enablement through the acquisition.
- 2019 – 2021Marketing ManagercPanel
Full-time · Event planner and marketing strategist for 500–3,000 attendee events and virtual series.
- 2017 – 2019FounderCMS Summit
The global CMS conference.
- 2007 – 2019CEO | FounderJoomlaxtc.com / Monev Software LLC
Premium Joomla templates and extensions. 101,000+ members.
- 2015 – 2019Board Member, Capital Team ChairJoomla! Project
Leadership, sponsorships, and partnerships for the open-source CMS.
- 2001 – 2005DeveloperPHP-Nuke · osCommerce era
First shipping code in the early open-source web.
Threat Briefing: 'php2shell' Leaked Zero-Days, Zeabur Shutdown & Hosting Provider Breaches
🚨 URGENT: Critical PHP Zero-Day Leak ('php2shell')
Two critical RCE vulnerabilities in the PHP core were leaked prior to today's scheduled emergency release. Dubbed "php2shell," these flaws allow unauthenticated attackers to execute code on the underlying server [1, 13].
- CVE / Severity: CVE-2026-109618 and CVE-2026-109619 (Critical / CVSS 10.0).
- Affected versions: All versions of PHP (7.x, 8.x) prior to the emergency releases [12].
- Fixed in: PHP 8.1.32, 8.2.26, and 8.3.14 (Expected release 14:00 UTC today) [3, 12].
- Action now:
- Monitor
php.netfor the release and rundnf update php/apt-get install --only-upgrade php*immediately upon availability. - For hosting providers: Coordinate with CloudLinux/cPanel for patched binaries.
- Check for suspicious processes spawned by the web user (e.g.,
www-dataornobodyrunning bash/sh) [1, 13].
- Monitor
🛡️ Hosting Infrastructure & Provider Incidents
- Zeabur Shutdown: The PaaS provider is ceasing operations after a second breach where attackers used leaked internal credentials to access the shared cluster, dedicated servers, and the platform database [10].
- Hosting Provider Breach (AfD Leak): A hosting provider compromise in September led to the leak of 420,000 records including bank statements and credentials; data is currently circulating on hacking forums [8, 9].
- AOMEI Update Hijack: Update servers for AOMEI software were compromised via configuration file manipulation, leading to a supply-chain risk for server backup infrastructure [7].
- cPanel Security Hardening: cPanel v138.0.1 now disables HTTP Basic Auth for ports 2082/2083 by default to prevent credential harvesting [11].
- Action now:
- Zeabur users: Migrate all data and rotate all environment variables immediately [10].
- cPanel admins: Transition to API tokens for all scripted interface calls [11].
🧩 WordPress Plugin Vulnerabilities & Exploits
-
Duplicator High-Severity Injection: A second-order PHP Object Injection vulnerability allows unauthenticated attackers to store malicious payloads in WordPress comments, which trigger when an admin views the Duplicator dashboard [2].
-
UpdraftCentral Connection Key Compromise: A breach of connection keys allows attackers to gain remote management access and install backdoors on linked WordPress sites [14].
-
Easy Property Listings Auth Bypass: An AJAX-based authorization flaw allows unauthenticated users to read private contact management data [4].
-
Duplicator (Free/Pro): Affected < 1.6.0. Fixed in 1.6.0. Action: Update via
wp plugin update duplicator. -
UpdraftCentral: Affected: All sites using existing keys. Action: Reset all UpdraftCentral connection keys and rotate site-wide salts [14].
-
Easy Property Listings: CVE-2026-96903. Affected < 3.5.27. Fixed in 3.5.27. Action: Update immediately [4].
On the
road.
Conferences, summits, and WordCamps I’ll be at in the months ahead.
- Nov 11 – 12, 2026
- State of the WordDec 2026
- Mar 15 – 18, 2027
When the servers
go quiet.
A small digital label putting out industrial house, progressive house, and dubstep. A different kind of open protocol.
Twenty years of showing up for the projects, communities, and voices that keep the open web open.
A news portal covering the hosting and domain industry — and a running excuse to keep talking to the people who build it.