Jason Nickerson — Hosting Industry InsiderTwo decades
inside the web
as it kept rewriting
itself.
I’m Jason, a hosting industry insider with experience across open-source CMS platforms, control panels, cloud infrastructure, and the events that bring the industry together. Today, I focus on building partnerships, programming industry summits, and documenting what is happening across the hosting ecosystem.
- Oct 21, 2026
OpenAI and the Search for More Than Just Chat
OpenAI's acquisition of Orchestra Bio shows a clear pivot toward vertical utility, moving from generic AI chatter to the high-stakes world of life sciences and drug discovery.
Read article: OpenAI and the Search for More Than Just Chat→ - Oct 21, 2026
Beta Season and the Persistence of the Staging Site
WordPress 7.2 Beta 1 is officially out for testing, offering a glimpse at the next iteration of the web's most dominant CMS without the corporate fluff.
Read article: Beta Season and the Persistence of the Staging Site→ - Oct 21, 2026
PHP Security Leaks and the Fragile Illusion of Coordinated Disclosure
When critical PHP vulnerabilities leak before the patch is ready, the hosting industry trades its sleep for a very long afternoon of fire drills.
Read article: PHP Security Leaks and the Fragile Illusion of Coordinated Disclosure→
The early 2000s were the good years for tinkerers. Open-source CMS platforms were the closest thing we had to a universal starter kit, and PHP-Nuke and osCommerce were how you learned to ship real projects on the open web. I went deep on Joomla for the better part of a decade, contributing code to the project, organizing its community around releases and events, and eventually crossing over into the WordPress orbit that quietly swallowed everything in its path.
From there the story is a tour of the hosting stack: cPanel and the control-panel era that defined shared hosting, the managed cloud wave at Cloudways and DigitalOcean, and the publishing side at webhosting.today. Day to day now I'm at JetBackup, working on backup and disaster recovery and helping hosts protect the infrastructure that keeps everything running. I also program the seasonal industry summits, Atlas Digital Summit and Domain Days Dubai, where the hosting community gathers to set the agenda for what comes next.
The through-line is community, the conferences, the hallway conversations, and the group chats where the industry actually decides what happens next. The technology changes; the people pointing it in the right direction stay the same.
Twenty-something years,
in reverse.
- 2026 – present
FounderAtlas Digital SummitPrivate gatherings for hosting leaders, AI infrastructure innovators, and the builders of the agentic web.
- 2026 – presentFounderConf64
The Conference Operating System for Business Development and Field Marketing Teams.
- 2026 – present
Co-FounderSuperDeployThe advanced migration engine for AI applications. Seamlessly transition your codebase to independent, production-grade infrastructure in minutes.
- 2025 – 2026Director of Business Developmentwebhosting.today
Contract · Business development and partnerships for the hosting publisher.
- 2024 – presentBusiness Development & Partnerships ManagerJetBackup
Backup and disaster recovery for the hosting ecosystem.
- 2023 – present
Chief Marketing Officer, Founding TeamDomain Days DubaiMENA’s domain and digital asset conference.
- 2021 – 2023Senior Manager, WordPress Business Unit → Lead Community Marketing Manager IICloudways / DigitalOcean
Full-time · WordPress community, field marketing, and sales enablement through the acquisition.
- 2019 – 2021Marketing ManagercPanel
Full-time · Event planner and marketing strategist for 500–3,000 attendee events and virtual series.
- 2017 – 2019FounderCMS Summit
The global CMS conference.
- 2007 – 2019CEO | FounderJoomlaxtc.com / Monev Software LLC
Premium Joomla templates and extensions. 101,000+ members.
- 2015 – 2019Board Member, Capital Team ChairJoomla! Project
Leadership, sponsorships, and partnerships for the open-source CMS.
- 2001 – 2005DeveloperPHP-Nuke · osCommerce era
First shipping code in the early open-source web.
Threat Briefing: 'php2shell' Leaked Zero-Days, Zeabur Shutdown & Hosting Provider Breaches
🚨 URGENT: Critical PHP Zero-Day Leak ('php2shell')
Two critical RCE vulnerabilities in the PHP core were leaked prior to today's scheduled emergency release. Dubbed "php2shell," these flaws allow unauthenticated attackers to execute code on the underlying server [1, 13].
- CVE / Severity: CVE-2026-109618 and CVE-2026-109619 (Critical / CVSS 10.0).
- Affected versions: All versions of PHP (7.x, 8.x) prior to the emergency releases [12].
- Fixed in: PHP 8.1.32, 8.2.26, and 8.3.14 (Expected release 14:00 UTC today) [3, 12].
- Action now:
- Monitor
php.netfor the release and rundnf update php/apt-get install --only-upgrade php*immediately upon availability. - For hosting providers: Coordinate with CloudLinux/cPanel for patched binaries.
- Check for suspicious processes spawned by the web user (e.g.,
www-dataornobodyrunning bash/sh) [1, 13].
- Monitor
🛡️ Hosting Infrastructure & Provider Incidents
- Zeabur Shutdown: The PaaS provider is ceasing operations after a second breach where attackers used leaked internal credentials to access the shared cluster, dedicated servers, and the platform database [10].
- Hosting Provider Breach (AfD Leak): A hosting provider compromise in September led to the leak of 420,000 records including bank statements and credentials; data is currently circulating on hacking forums [8, 9].
- AOMEI Update Hijack: Update servers for AOMEI software were compromised via configuration file manipulation, leading to a supply-chain risk for server backup infrastructure [7].
- cPanel Security Hardening: cPanel v138.0.1 now disables HTTP Basic Auth for ports 2082/2083 by default to prevent credential harvesting [11].
- Action now:
- Zeabur users: Migrate all data and rotate all environment variables immediately [10].
- cPanel admins: Transition to API tokens for all scripted interface calls [11].
🧩 WordPress Plugin Vulnerabilities & Exploits
-
Duplicator High-Severity Injection: A second-order PHP Object Injection vulnerability allows unauthenticated attackers to store malicious payloads in WordPress comments, which trigger when an admin views the Duplicator dashboard [2].
-
UpdraftCentral Connection Key Compromise: A breach of connection keys allows attackers to gain remote management access and install backdoors on linked WordPress sites [14].
-
Easy Property Listings Auth Bypass: An AJAX-based authorization flaw allows unauthenticated users to read private contact management data [4].
-
Duplicator (Free/Pro): Affected < 1.6.0. Fixed in 1.6.0. Action: Update via
wp plugin update duplicator. -
UpdraftCentral: Affected: All sites using existing keys. Action: Reset all UpdraftCentral connection keys and rotate site-wide salts [14].
-
Easy Property Listings: CVE-2026-96903. Affected < 3.5.27. Fixed in 3.5.27. Action: Update immediately [4].
On the
road.
Conferences, summits, and WordCamps I’ll be at in the months ahead.
- Nov 11 – 12, 2026
- State of the WordDec 2026
- Mar 15 – 18, 2027
When the servers
go quiet.
A small digital label putting out industrial house, progressive house, and dubstep. A different kind of open protocol.
Twenty years of showing up for the projects, communities, and voices that keep the open web open.
A news portal covering the hosting and domain industry — and a running excuse to keep talking to the people who build it.