Jason Nickerson — Hosting Industry InsiderTwo decades
inside the web
as it kept rewriting
itself.
I’m Jason, a hosting industry insider with experience across open-source CMS platforms, control panels, cloud infrastructure, and the events that bring the industry together. Today, I focus on building partnerships, programming industry summits, and documenting what is happening across the hosting ecosystem.
- Sep 30, 2026
Actuaries in Orbit: Why Space Needs a Better Underwriter
Traditional insurance companies panic the moment they hear orbital mechanics. Charter Space just raised $5M to bridge the gap between scary science and sound business.
Read article: Actuaries in Orbit: Why Space Needs a Better Underwriter→ - Sep 30, 2026
The Speed of the Exploit is the New Baseline
WordPress 7.1.2 was exploited within hours of release, proving that your security strategy can no longer rely on a human being clicking an update button.
Read article: The Speed of the Exploit is the New Baseline→ - Sep 29, 2026
Apologies Won’t Patch a Broken Bot
OpenAI's latest 'oops' moment in Australia highlights a growing gap between AI ambition and the practical realities of digital sovereignty.
Read article: Apologies Won’t Patch a Broken Bot→
The early 2000s were the good years for tinkerers. Open-source CMS platforms were the closest thing we had to a universal starter kit, and PHP-Nuke and osCommerce were how you learned to ship real projects on the open web. I went deep on Joomla for the better part of a decade, contributing code to the project, organizing its community around releases and events, and eventually crossing over into the WordPress orbit that quietly swallowed everything in its path.
From there the story is a tour of the hosting stack: cPanel and the control-panel era that defined shared hosting, the managed cloud wave at Cloudways and DigitalOcean, and the publishing side at webhosting.today. Day to day now I'm at JetBackup, working on backup and disaster recovery and helping hosts protect the infrastructure that keeps everything running. I also program the seasonal industry summits, Atlas Digital Summit and Domain Days Dubai, where the hosting community gathers to set the agenda for what comes next.
The through-line is community, the conferences, the hallway conversations, and the group chats where the industry actually decides what happens next. The technology changes; the people pointing it in the right direction stay the same.
Twenty-something years,
in reverse.
- 2026 – present
FounderAtlas Digital SummitPrivate gatherings for hosting leaders, AI infrastructure innovators, and the builders of the agentic web.
- 2026 – presentFounderConf64
The Conference Operating System for Business Development and Field Marketing Teams.
- 2026 – present
Co-FounderSuperDeployThe advanced migration engine for AI applications. Seamlessly transition your codebase to independent, production-grade infrastructure in minutes.
- 2025 – 2026Director of Business Developmentwebhosting.today
Contract · Business development and partnerships for the hosting publisher.
- 2024 – presentBusiness Development & Partnerships ManagerJetBackup
Backup and disaster recovery for the hosting ecosystem.
- 2023 – present
Chief Marketing Officer, Founding TeamDomain Days DubaiMENA’s domain and digital asset conference.
- 2021 – 2023Senior Manager, WordPress Business Unit → Lead Community Marketing Manager IICloudways / DigitalOcean
Full-time · WordPress community, field marketing, and sales enablement through the acquisition.
- 2019 – 2021Marketing ManagercPanel
Full-time · Event planner and marketing strategist for 500–3,000 attendee events and virtual series.
- 2017 – 2019FounderCMS Summit
The global CMS conference.
- 2007 – 2019CEO | FounderJoomlaxtc.com / Monev Software LLC
Premium Joomla templates and extensions. 101,000+ members.
- 2015 – 2019Board Member, Capital Team ChairJoomla! Project
Leadership, sponsorships, and partnerships for the open-source CMS.
- 2001 – 2005DeveloperPHP-Nuke · osCommerce era
First shipping code in the early open-source web.
Threat Briefing: KEV Zero-Day Exploits, cPanel PrivEsc & Kapibala Campaign
🚨 TOP ALERT: KEV Additions & Zero-Day Exploitation
Two critical vulnerabilities have been added to the CISA Known Exploited Vulnerabilities (KEV) Catalog as of late yesterday, signaling active exploitation in the wild [2]. While these are high-impact, agencies should also monitor the "Kapibala" actor, who has been observed pivoting from initial WordPress compromises to government record systems throughout September 2026 [4].
🛡️ INFRASTRUCTURE & HOSTING
cPanel & WHM / Plesk Privilege Escalation — A critical incorrect default permissions vulnerability allows local users to escalate privileges to root on affected hosting nodes [13].
- CVE / severity: Not explicitly assigned in source (referenced via SecuBuzz/CISA) / High
- Affected versions: cPanel & WHM (all versions prior to current patch), Plesk extensions
- Fixed in: Latest security releases for cPanel/WHM and Plesk
- Action now:
- Run
/scripts/upcpon cPanel nodes immediately. - Audit server for non-standard file permissions in
/usr/local/cpaneland plugin directories. - Review active SSH sessions for anomalous user behavior.
- Run
CVE-2026-88771 & CVE-2026-88772 Zero-Day Exploits — CISA has confirmed these vulnerabilities are being used in active attacks. While specific vendor names were omitted in the summary, they are categorized as high-impact infrastructure targets [2].
- CVE / severity: CVE-2026-88771, CVE-2026-88772 / Critical
- Affected versions: Not disclosed in sources
- Fixed in: Check vendor-specific KEV updates for immediate patches
- Action now:
- Prioritize patching these IDs over all other scheduled maintenance.
- Check CISA KEV catalog for specific vendor remediation steps.
🖥️ CMS & WORDPRESS
HT Contact Form 7 Plugin Unauthenticated Stored XSS — A vulnerability in this popular form builder allows unauthenticated attackers to inject malicious scripts into the WordPress database via the drag-and-drop interface [14].
- CVE / severity: no CVE assigned / Medium (CVSS 6.4)
- Affected versions: HT Contact Form 7 Plugin <= 2.10.2
- Fixed in: 2.10.3 (or latest available version)
- Action now:
- Run
wp plugin update ht-contactformimmediately. - Scan the
wp_optionsandwp_poststables for unexpected<script>or<iframe>tags.
- Run
Kapibala Campaign (WordPress-to-Gov) — A single threat actor is using specific WordPress usernames (nicknamed "Kapibala") to bridge from public sites into sensitive backend infrastructure [4].
- Indicators of Compromise (IoC): Look for new users with "Kapibala" in the slug or username.
- Action now:
- Enforce 2FA for all administrative accounts.
- Monitor access logs for unauthorized attempts to reach
/wp-admin/from unusual geolocations.
🍏 CLIENT-SIDE / WORKSTATION
Apple CoreGraphics RCE — Infrastructure teams using macOS for administration should patch immediately against a flaw that triggers code execution via malicious files [3].
- CVE / severity: CVE-2026-86950 / Critical
- Affected versions: macOS Sonoma, iOS, and iPadOS (version ranges vary)
- Fixed in: macOS 15.x / iOS 18.x latest security updates
- Action now: Update all admin workstations via System Settings > Software Update.
On the
road.
Conferences, summits, and WordCamps I’ll be at in the months ahead.
- Aug 16 – 19, 2026
- Sep 28 – 29, 2026
- Domain Days DubaiRescheduled
New dates to be announced.
Oct 15 – 16, 2026 - Nov 11 – 12, 2026
- State of the WordDec 2026
- Mar 15 – 18, 2027
When the servers
go quiet.
A small digital label putting out industrial house, progressive house, and dubstep. A different kind of open protocol.
Twenty years of showing up for the projects, communities, and voices that keep the open web open.
A news portal covering the hosting and domain industry — and a running excuse to keep talking to the people who build it.