Jason Nickerson — Hosting Industry InsiderTwo decades
inside the web
as it kept rewriting
itself.
I’m Jason, a hosting industry insider with experience across open-source CMS platforms, control panels, cloud infrastructure, and the events that bring the industry together. Today, I focus on building partnerships, programming industry summits, and documenting what is happening across the hosting ecosystem.
- Nov 7, 2026
OpenAI and the Trillion-Dollar Weight of Expectations
OpenAI's latest $11 billion funding round at a $1.25 trillion valuation proves that in the AI arms race, 'too big to fail' is now the entry-level requirement.
Read article: OpenAI and the Trillion-Dollar Weight of Expectations→ - Nov 7, 2026
When the Panel Becomes the Problem
A deep dive into CWPdoor and why free hosting panels continue to be the favorite playground for sophisticated backdoor attacks.
Read article: When the Panel Becomes the Problem→ - Nov 6, 2026
Teaching Robots to Shop: The Weird Bridge Between E-Commerce and AI Training
Physicl just snagged $10M to turn product marketing assets into training grounds for robots, finally finding a productive use for high-fidelity 3D renders.
Read article: Teaching Robots to Shop: The Weird Bridge Between E-Commerce and AI Training→
The early 2000s were the good years for tinkerers. Open-source CMS platforms were the closest thing we had to a universal starter kit, and PHP-Nuke and osCommerce were how you learned to ship real projects on the open web. I went deep on Joomla for the better part of a decade, contributing code to the project, organizing its community around releases and events, and eventually crossing over into the WordPress orbit that quietly swallowed everything in its path.
From there the story is a tour of the hosting stack: cPanel and the control-panel era that defined shared hosting, the managed cloud wave at Cloudways and DigitalOcean, and the publishing side at webhosting.today. Day to day now I'm at JetBackup, working on backup and disaster recovery and helping hosts protect the infrastructure that keeps everything running. I also program the seasonal industry summits, Atlas Digital Summit and Domain Days Dubai, where the hosting community gathers to set the agenda for what comes next.
The through-line is community, the conferences, the hallway conversations, and the group chats where the industry actually decides what happens next. The technology changes; the people pointing it in the right direction stay the same.
Twenty-something years,
in reverse.
- 2026 – present
FounderAtlas Digital SummitPrivate gatherings for hosting leaders, AI infrastructure innovators, and the builders of the agentic web.
- 2026 – presentFounderConf64
The Conference Operating System for Business Development and Field Marketing Teams.
- 2026 – present
Co-FounderSuperDeployThe advanced migration engine for AI applications. Seamlessly transition your codebase to independent, production-grade infrastructure in minutes.
- 2025 – 2026Director of Business Developmentwebhosting.today
Contract · Business development and partnerships for the hosting publisher.
- 2024 – presentBusiness Development & Partnerships ManagerJetBackup
Backup and disaster recovery for the hosting ecosystem.
- 2023 – present
Chief Marketing Officer, Founding TeamDomain Days DubaiMENA’s domain and digital asset conference.
- 2021 – 2023Senior Manager, WordPress Business Unit → Lead Community Marketing Manager IICloudways / DigitalOcean
Full-time · WordPress community, field marketing, and sales enablement through the acquisition.
- 2019 – 2021Marketing ManagercPanel
Full-time · Event planner and marketing strategist for 500–3,000 attendee events and virtual series.
- 2017 – 2019FounderCMS Summit
The global CMS conference.
- 2007 – 2019CEO | FounderJoomlaxtc.com / Monev Software LLC
Premium Joomla templates and extensions. 101,000+ members.
- 2015 – 2019Board Member, Capital Team ChairJoomla! Project
Leadership, sponsorships, and partnerships for the open-source CMS.
- 2001 – 2005DeveloperPHP-Nuke · osCommerce era
First shipping code in the early open-source web.
Threat Briefing: DreamHost Infrastructure Breach & Critical WP Plugin RCEs
1. Infrastructure & Hosting Provider Incidents
-
DreamHost Infrastructure Breach: A critical intrusion targeting the
files.dreamhost.comweb-based File Manager has exposed FTP credentials and webmail data [10][11]. The attacker leveraged an application-layer vulnerability to gain unauthorized access to the server environment [10].- Affected versions: Users of the DreamHost web-based File Manager prior to November 2026 [11].
- Fixed in: Infrastructure-side mitigation complete; user-side credential rotation required [11].
- Action now:
- Rotate all FTP/SFTP and SSH passwords immediately.
- Reset all webmail account passwords.
- Review File Manager logs for unauthorized file uploads or modifications.
-
cPanel & WHM Authentication Bypass (Retrospective Alert): New reports highlight the exploitation of a previously disclosed bypass (CVE-2026-41940) by sophisticated actors [14].
- CVE / Severity: CVE-2026-41940 / High (not disclosed in sources).
- Affected versions: Select versions of cPanel and WebHost Manager [14].
- Action now:
- Run
/usr/local/cpanel/scripts/upcpto ensure the latest security tier is installed. - Audit WHM login logs for unrecognized IP addresses.
- Run
2. Active WordPress Core & Server-Side Language Exploits
-
WordPress Core Update Race Condition: CISA has confirmed active exploitation of CVE-2026-119977. This "update-window" flaw allows attackers to hijack the site precisely during the core update process, rendering standard security plugins ineffective [3][4].
- CVE / Severity: CVE-2026-119977 / Low (WordPress rating) to Critical (CISA observed impact).
- Affected versions: WordPress Core versions prior to 7.1.4 [3].
- Fixed in: WordPress 7.1.4.
- Action now:
- Force update to WordPress 7.1.4 via WP-CLI:
wp core update. - Monitor for unauthorized files in
wp-adminorwp-includesimmediately following an update cycle [4].
- Force update to WordPress 7.1.4 via WP-CLI:
-
PHP Zero-Day Leak: Reports confirm that critical bugs in PHP were leaked and exploited 4 days prior to public disclosure in October/November, affecting the foundational language for WordPress and hosting stacks [13].
- Action now: Ensure PHP is updated to the latest stable minor version (e.g., 8.2.x or 8.3.x) via
dnf update phporapt upgrade phpto capture recent emergency patches [13].
- Action now: Ensure PHP is updated to the latest stable minor version (e.g., 8.2.x or 8.3.x) via
3. Critical WordPress Plugin Vulnerabilities
-
WP Libre Form Unauthenticated RCE: A critical flaw in the file upload mechanism allows unauthenticated attackers to upload arbitrary PHP files, leading to full server compromise [1][5].
- CVE / Severity: CVE-2026-118423 / 10.0 (Critical) [5].
- Affected versions: WP Libre Form 1.5.0 and 1.5.0.1 [1][5].
- Fixed in: Not disclosed in sources; recommended to deactivate plugin until patch is verified [1].
- Action now:
wp plugin deactivate wp-libre-form.
-
Appointment Booking (LatePoint) Auth Bypass: A flaw in the password reset logic using an
IS NOT NULLsentinel allows unauthenticated account takeover [9].- CVE / Severity: No CVE assigned / Critical.
- Affected versions: LatePoint <= 5.7.6 [9].
- Fixed in: LatePoint 5.7.7.
- Action now: Update to version 5.7.7 via the plugin dashboard or developer site [9].
-
ELEX WordPress HelpDesk Path Traversal: Attackers can delete arbitrary files, potentially triggering RCE by removing critical configuration files [6].
- CVE / Severity: CVE-2026-114630 / High.
- Affected versions: ELEX WordPress HelpDesk (specific versions not disclosed) [6].
- Action now: Update to the latest version and restrict access to the
/wp-admin/admin-ajax.phpendpoints used by the plugin [6].
On the
road.
Conferences, summits, and WordCamps I’ll be at in the months ahead.
- Nov 11 – 12, 2026
- State of the WordDec 2026
- Mar 15 – 18, 2027
When the servers
go quiet.
A small digital label putting out industrial house, progressive house, and dubstep. A different kind of open protocol.
Twenty years of showing up for the projects, communities, and voices that keep the open web open.
A news portal covering the hosting and domain industry — and a running excuse to keep talking to the people who build it.