Jason Nickerson — Hosting Industry InsiderTwo decades
inside the web
as it kept rewriting
itself.
I’m Jason, a hosting industry insider with experience across open-source CMS platforms, control panels, cloud infrastructure, and the events that bring the industry together. Today, I focus on building partnerships, programming industry summits, and documenting what is happening across the hosting ecosystem.
- Sep 19, 2026
Patch First, Debrief Later: The Reality of 7.1.1
WordPress 7.1.1 is out with 11 security fixes and nearly 40 bug patches. If you haven't checked your dashboard yet, now is the time to verify those auto-updates actually ran.
Read article: Patch First, Debrief Later: The Reality of 7.1.1→ - Sep 18, 2026
Data Centers Are Just AI Factories Now
Crusoe's massive new funding round proves that the old guard of web hosting and the new giants of AI infrastructure are now playing entirely different games.
Read article: Data Centers Are Just AI Factories Now→ - Sep 18, 2026
Root Access is Never a Gift: The Acronis Plugin Patch
A privilege-escalation vulnerability in the Acronis cPanel plugin reminds us that even our security tools can become the primary vector for a server compromise if permissions aren't tight.
Read article: Root Access is Never a Gift: The Acronis Plugin Patch→
The early 2000s were the good years for tinkerers. Open-source CMS platforms were the closest thing we had to a universal starter kit, and PHP-Nuke and osCommerce were how you learned to ship real projects on the open web. I went deep on Joomla for the better part of a decade, contributing code to the project, organizing its community around releases and events, and eventually crossing over into the WordPress orbit that quietly swallowed everything in its path.
From there the story is a tour of the hosting stack: cPanel and the control-panel era that defined shared hosting, the managed cloud wave at Cloudways and DigitalOcean, and the publishing side at webhosting.today. Day to day now I'm at JetBackup, working on backup and disaster recovery and helping hosts protect the infrastructure that keeps everything running. I also program the seasonal industry summits, Atlas Digital Summit and Domain Days Dubai, where the hosting community gathers to set the agenda for what comes next.
The through-line is community, the conferences, the hallway conversations, and the group chats where the industry actually decides what happens next. The technology changes; the people pointing it in the right direction stay the same.
Twenty-something years,
in reverse.
- 2026 – present
FounderAtlas Digital SummitPrivate gatherings for hosting leaders, AI infrastructure innovators, and the builders of the agentic web.
- 2026 – presentFounderConf64
The Conference Operating System for Business Development and Field Marketing Teams.
- 2026 – present
Co-FounderSuperDeployThe advanced migration engine for AI applications. Seamlessly transition your codebase to independent, production-grade infrastructure in minutes.
- 2025 – 2026Director of Business Developmentwebhosting.today
Contract · Business development and partnerships for the hosting publisher.
- 2024 – presentBusiness Development & Partnerships ManagerJetBackup
Backup and disaster recovery for the hosting ecosystem.
- 2023 – present
Chief Marketing Officer, Founding TeamDomain Days DubaiMENA’s domain and digital asset conference.
- 2021 – 2023Senior Manager, WordPress Business Unit → Lead Community Marketing Manager IICloudways / DigitalOcean
Full-time · WordPress community, field marketing, and sales enablement through the acquisition.
- 2019 – 2021Marketing ManagercPanel
Full-time · Event planner and marketing strategist for 500–3,000 attendee events and virtual series.
- 2017 – 2019FounderCMS Summit
The global CMS conference.
- 2007 – 2019CEO | FounderJoomlaxtc.com / Monev Software LLC
Premium Joomla templates and extensions. 101,000+ members.
- 2015 – 2019Board Member, Capital Team ChairJoomla! Project
Leadership, sponsorships, and partnerships for the open-source CMS.
- 2001 – 2005DeveloperPHP-Nuke · osCommerce era
First shipping code in the early open-source web.
Threat Briefing: Linux Kernel KEV Additions, cPanel Root Bypass & WordPress Plugin RCEs
1. Infrastructure & Server Layer (Linux, cPanel, Orkes)
CISA KEV Alert: Active Linux Kernel Privilege Escalation — Three kernel flaws added to CISA's Known Exploited Vulnerabilities catalog. Concurrently, four new LPE vulnerabilities (DirtyAH6, TUNderflow, PPPoEject, DiagSpill) have been disclosed by researchers [13][14].
- CVE / severity: CVE-2026-53362 (Critical), CVE-2026-80844, CVE-2026-81000, CVE-2026-68121, CVE-2026-74469.
- Affected versions: Impacting wide ranges of enterprise Linux kernels; specific versions not disclosed in sources.
- Fixed in: Latest stable kernel releases (Distro-specific).
- Action now: Run
yum update kernelorapt-get upgrade linux-image-genericimmediately; reboot servers to apply kernel patches.
cPanel/WHM Critical Authentication Bypass — A session injection and JSON cache exploitation path allows unauthenticated attackers to escalate to root access [10].
- CVE / severity: CVE-2026-41940 (Critical).
- Affected versions: cPanel & WHM versions not explicitly listed in source; targets session handling.
- Fixed in: Not disclosed in sources; check cPanel Security Advisor [11].
- Action now: Run
/scripts/upcpto ensure the latest security tier is applied; monitor/usr/local/cpanel/logs/access_logfor unauthorized session injections.
Orkes Conductor Workflow Server Exploitation — Workflow automation servers are being actively targeted in the wild, risking full infrastructure compromise [3].
- CVE / severity: No CVE assigned (Active Exploitation).
- Affected versions: Orkes Conductor instances.
- Fixed in: Not disclosed in sources.
- Action now: Isolate Conductor instances from the public internet; check for unauthorized workflow executions and audit system logs.
2. WordPress CMS (Plugins & Core)
Gravity Forms Arbitrary File Upload — A critical flaw in the upload_file function allows remote code execution via unauthorized file uploads [6].
- CVE / severity: No CVE assigned (Critical).
- Affected versions: Gravity Forms <= 3.1.0.4.
- Fixed in: Not disclosed in sources.
- Action now: Temporarily disable file upload fields in active forms; restrict access to the WordPress
wp-content/uploads/gravity_formsdirectory.
Secure Custom Fields (SCF) Form Verification Bypass — Failure to verify front-end form submissions against rendered forms allows data manipulation [4].
- CVE / severity: CVE-2026-92403 (High).
- Affected versions: Secure Custom Fields < 6.9.4.
- Fixed in: Version 6.9.4.
- Action now:
wp plugin update secure-custom-fieldsto version 6.9.4.
AyeCode Location Manager SQL Injection — A generic SQLi vulnerability allows attackers to extract database contents [5].
- CVE / severity: CVE-2026-85705 (High).
- Affected versions: AyeCode Ltd Location Manager (versions not specified).
- Fixed in: Check for latest plugin updates via WordPress dashboard.
- Action now: Apply available updates; implement WAF rules to block common SQL injection strings (UNION SELECT, etc.).
3. Data Incidents & Exposure
LMU Munich Student Data Breach — Unauthorized access to student registration data identified on Sept 16, 2026, targeting IT system storage [8].
- Status: Active Investigation.
- Action now: Hosting teams should verify integrity of registration/membership databases and rotate administrative credentials if any crossover with educational infrastructure exists.
Plugin Information Exposure (Bread & Divi Essential) — Two major plugins are leaking sensitive configuration and data via public exports/endpoints [1][2].
- CVE / severity: CVE-2026-4792 (Bread) / CVE-2026-15760 (Divi Essential).
- Affected versions: Bread <= 2.9.12; Divi Essential <= 5.8.1.
- Action now: Update Bread to 2.9.13+ and Divi Essential to 5.8.2+; confirm that
.jsonor.csvexport directories are not indexed by search engines.
On the
road.
Conferences, summits, and WordCamps I’ll be at in the months ahead.
- Aug 16 – 19, 2026
- Sep 28 – 29, 2026
- Domain Days DubaiRescheduled
New dates to be announced.
Oct 15 – 16, 2026 - Nov 11 – 12, 2026
- State of the WordDec 2026
- Mar 15 – 18, 2027
When the servers
go quiet.
A small digital label putting out industrial house, progressive house, and dubstep. A different kind of open protocol.
Twenty years of showing up for the projects, communities, and voices that keep the open web open.
A news portal covering the hosting and domain industry — and a running excuse to keep talking to the people who build it.