Jason Nickerson — Hosting Industry InsiderTwo decades
inside the web
as it kept rewriting
itself.
I’m Jason, a hosting industry insider with experience across open-source CMS platforms, control panels, cloud infrastructure, and the events that bring the industry together. Today, I focus on building partnerships, programming industry summits, and documenting what is happening across the hosting ecosystem.
- Oct 3, 2026
Sean Parker, Music, and the Long Game of Forgiveness
Twenty-five years after Napster, Sean Parker is steering Stability AI back into the music business—this time with the labels actually writing the checks.
Read article: Sean Parker, Music, and the Long Game of Forgiveness→ - Oct 2, 2026
Kevin Mandia’s $2.5 Billion Bet on the Swarm
Kevin Mandia is back with Armadin, a startup leveraging AI agent swarms to automate enterprise security at a staggering multi-billion dollar valuation.
Read article: Kevin Mandia’s $2.5 Billion Bet on the Swarm→ - Oct 2, 2026
Keeping European Data in a European Cloud
OVHcloud and CGI land a major ESA contract, proving that sovereign infrastructure is more than just a marketing buzzword for the European hosting sector.
Read article: Keeping European Data in a European Cloud→
The early 2000s were the good years for tinkerers. Open-source CMS platforms were the closest thing we had to a universal starter kit, and PHP-Nuke and osCommerce were how you learned to ship real projects on the open web. I went deep on Joomla for the better part of a decade, contributing code to the project, organizing its community around releases and events, and eventually crossing over into the WordPress orbit that quietly swallowed everything in its path.
From there the story is a tour of the hosting stack: cPanel and the control-panel era that defined shared hosting, the managed cloud wave at Cloudways and DigitalOcean, and the publishing side at webhosting.today. Day to day now I'm at JetBackup, working on backup and disaster recovery and helping hosts protect the infrastructure that keeps everything running. I also program the seasonal industry summits, Atlas Digital Summit and Domain Days Dubai, where the hosting community gathers to set the agenda for what comes next.
The through-line is community, the conferences, the hallway conversations, and the group chats where the industry actually decides what happens next. The technology changes; the people pointing it in the right direction stay the same.
Twenty-something years,
in reverse.
- 2026 – present
FounderAtlas Digital SummitPrivate gatherings for hosting leaders, AI infrastructure innovators, and the builders of the agentic web.
- 2026 – presentFounderConf64
The Conference Operating System for Business Development and Field Marketing Teams.
- 2026 – present
Co-FounderSuperDeployThe advanced migration engine for AI applications. Seamlessly transition your codebase to independent, production-grade infrastructure in minutes.
- 2025 – 2026Director of Business Developmentwebhosting.today
Contract · Business development and partnerships for the hosting publisher.
- 2024 – presentBusiness Development & Partnerships ManagerJetBackup
Backup and disaster recovery for the hosting ecosystem.
- 2023 – present
Chief Marketing Officer, Founding TeamDomain Days DubaiMENA’s domain and digital asset conference.
- 2021 – 2023Senior Manager, WordPress Business Unit → Lead Community Marketing Manager IICloudways / DigitalOcean
Full-time · WordPress community, field marketing, and sales enablement through the acquisition.
- 2019 – 2021Marketing ManagercPanel
Full-time · Event planner and marketing strategist for 500–3,000 attendee events and virtual series.
- 2017 – 2019FounderCMS Summit
The global CMS conference.
- 2007 – 2019CEO | FounderJoomlaxtc.com / Monev Software LLC
Premium Joomla templates and extensions. 101,000+ members.
- 2015 – 2019Board Member, Capital Team ChairJoomla! Project
Leadership, sponsorships, and partnerships for the open-source CMS.
- 2001 – 2005DeveloperPHP-Nuke · osCommerce era
First shipping code in the early open-source web.
Threat Briefing: GitLab Path Traversal Exploitation, Linux 0-Days & WP Plugin RCE
1. INFRASTRUCTURE: Active GitLab Exploitation & Linux 0-Days
A critical path-traversal vulnerability in GitLab has transitioned from theoretical risk to active exploitation in the wild, targeting self-managed instances [3]. Simultaneously, multiple unspecified Linux Kernel vulnerabilities, including race conditions and OOB writes, are currently listed as actively exploited 0-days [10].
GitLab Path Traversal
- CVE / severity: CVE-2026-85706 (Critical)
- Affected versions: Self-managed GitLab (specific version range not disclosed in sources)
- Fixed in: Latest GitLab security release (refer to official GitLab security dashboard)
- Action now: Immediately update self-managed GitLab instances; monitor for unusual file access patterns in application logs [3].
Linux Kernel Zero-Days
- CVE / severity: Multiple (including Race Conditions and OOB Writes) / Critical [10]
- Affected versions: Various Linux Distributions; Debian 13 (Trixie) users specifically noted [11]
- Fixed in: Linux 6.12.111-1 (for Debian Trixie) [11]
- Action now: Execute
apt-get update && apt-get upgradeon Debian systems; apply latest kernel patches across all Linux fleets to mitigate 0-day activity [10][11].
2. WORDPRESS: Critical RCE & Privilege Escalation
A high-impact RCE vulnerability in the Drag and Drop File Upload for Elementor Forms plugin allows unauthenticated attackers to upload malicious files and achieve full site takeover [5]. Additionally, a significant privilege escalation flaw in Ultimate Member allows authorization bypass [7].
Drag and Drop File Upload for Elementor Forms RCE
- CVE / severity: CVE-2026-18351 (Critical)
- Affected versions: Versions not explicitly listed; impacts "Drag and Drop File Upload for Elementor Forms"
- Fixed in: Not disclosed in sources
- Action now: Deactivate plugin until a patch is confirmed; check
/wp-content/uploads/for unauthorized PHP files [5].
Ultimate Member Privilege Escalation
- CVE / severity: CVE-2026-96451 (Critical)
- Affected versions: Ultimate Member <= 2.13.1
- Fixed in: Not disclosed in sources
- Action now: Audit user accounts for unauthorized Admin roles; update to latest version or restrict user registration until patched [7].
3. HOSTING & CMS: Fedora WP Packages & Plugin Vulnerabilities
Fedora has issued security advisories for WordPress core packages due to vulnerabilities in version 6.9.9 [2][6]. Furthermore, VikAppointments faces a critical file deletion flaw, and WPC Smart Quick View is vulnerable to XSS [1][9].
WordPress VikAppointments Arbitrary File Deletion
- CVE / severity: CVE-2026-87115 (High)
- Affected versions: VikAppointments Services Booking Calendar (versions not specified)
- Fixed in: Not disclosed in sources
- Action now: Update plugin to latest version via
wp plugin update vikappointments-calendar[1].
Fedora WordPress Core Update
- CVE / severity: FEDORA-2026-5c9d8e41a9 / FEDORA-2026-7f9c69a63c
- Affected versions: Fedora 43 and Fedora 44 hosting WordPress 6.9.9
- Fixed in: Refer to Fedora advisory packages
- Action now: Run
dnf update wordpresson affected Fedora hosts [2][6].
4. NETWORK & ACCESS: Citrix 0-Day Stability & SSH RCE
Administrators report that Citrix NetScaler appliances are experiencing repeated reboots and crashes following the application of emergency 0-day patches [8]. Additionally, a critical SSH protocol flaw enables unauthorized command execution [13].
SSH Protocol Command Execution
- CVE / severity: CVE-2025-32433 (Critical)
- Affected versions: Systems utilizing vulnerable SSH protocol message handling
- Fixed in: Not disclosed in sources
- Action now: Restrict SSH access to trusted IPs; audit SSH logs for unusual message handling errors [13].
Citrix NetScaler Crash Loop
- CVE / severity: No CVE assigned for the reboot issue (post-0-day patch)
- Affected versions: NetScaler appliances recently patched for 0-days
- Fixed in: Pending further Citrix updates
- Action now: Monitor appliance stability; contact Citrix support if reboot cycles occur post-patch [8].
On the
road.
Conferences, summits, and WordCamps I’ll be at in the months ahead.
- Aug 16 – 19, 2026
- Sep 28 – 29, 2026
- Domain Days DubaiRescheduled
New dates to be announced.
Oct 15 – 16, 2026 - Nov 11 – 12, 2026
- State of the WordDec 2026
- Mar 15 – 18, 2027
When the servers
go quiet.
A small digital label putting out industrial house, progressive house, and dubstep. A different kind of open protocol.
Twenty years of showing up for the projects, communities, and voices that keep the open web open.
A news portal covering the hosting and domain industry — and a running excuse to keep talking to the people who build it.