Jason Nickerson — Hosting Industry InsiderTwo decades
inside the web
as it kept rewriting
itself.
I’m Jason, a hosting industry insider with experience across open-source CMS platforms, control panels, cloud infrastructure, and the events that bring the industry together. Today, I focus on building partnerships, programming industry summits, and documenting what is happening across the hosting ecosystem.
- Sep 11, 2026
Monarx Tackles the Dark Web Without the Usual Hosting Friction
Monarx's new white-label Dark Web Monitoring gives hosting providers a way to protect customer domains without the typical per-user configuration headaches.
Read article: Monarx Tackles the Dark Web Without the Usual Hosting Friction→ - Sep 10, 2026
Your Driver's License Just Joined the Public Domain
Identity verification giant IDScan has confirmed a massive breach affecting 150 million records, proving once again that centralized data is just a shiny target.
Read article: Your Driver's License Just Joined the Public Domain→ - Sep 9, 2026
When AI Agents Start Acting Like Bad Employees
Sequoia's $25 million bet on Cymphony highlights the next major shift in enterprise security: protecting the company from its own autonomous agents.
Read article: When AI Agents Start Acting Like Bad Employees→
The early 2000s were the good years for tinkerers. Open-source CMS platforms were the closest thing we had to a universal starter kit, and PHP-Nuke and osCommerce were how you learned to ship real projects on the open web. I went deep on Joomla for the better part of a decade, contributing code to the project, organizing its community around releases and events, and eventually crossing over into the WordPress orbit that quietly swallowed everything in its path.
From there the story is a tour of the hosting stack: cPanel and the control-panel era that defined shared hosting, the managed cloud wave at Cloudways and DigitalOcean, and the publishing side at webhosting.today. Day to day now I'm at JetBackup, working on backup and disaster recovery and helping hosts protect the infrastructure that keeps everything running. I also program the seasonal industry summits, Atlas Digital Summit and Domain Days Dubai, where the hosting community gathers to set the agenda for what comes next.
The through-line is community, the conferences, the hallway conversations, and the group chats where the industry actually decides what happens next. The technology changes; the people pointing it in the right direction stay the same.
Twenty-something years,
in reverse.
- 2026 – present
FounderAtlas Digital SummitPrivate gatherings for hosting leaders, AI infrastructure innovators, and the builders of the agentic web.
- 2026 – presentFounderConf64
The Conference Operating System for Business Development and Field Marketing Teams.
- 2026 – present
Co-FounderSuperDeployThe advanced migration engine for AI applications. Seamlessly transition your codebase to independent, production-grade infrastructure in minutes.
- 2025 – 2026Director of Business Developmentwebhosting.today
Contract · Business development and partnerships for the hosting publisher.
- 2024 – presentBusiness Development & Partnerships ManagerJetBackup
Backup and disaster recovery for the hosting ecosystem.
- 2023 – present
Chief Marketing Officer, Founding TeamDomain Days DubaiMENA’s domain and digital asset conference.
- 2021 – 2023Senior Manager, WordPress Business Unit → Lead Community Marketing Manager IICloudways / DigitalOcean
Full-time · WordPress community, field marketing, and sales enablement through the acquisition.
- 2019 – 2021Marketing ManagercPanel
Full-time · Event planner and marketing strategist for 500–3,000 attendee events and virtual series.
- 2017 – 2019FounderCMS Summit
The global CMS conference.
- 2007 – 2019CEO | FounderJoomlaxtc.com / Monev Software LLC
Premium Joomla templates and extensions. 101,000+ members.
- 2015 – 2019Board Member, Capital Team ChairJoomla! Project
Leadership, sponsorships, and partnerships for the open-source CMS.
- 2001 – 2005DeveloperPHP-Nuke · osCommerce era
First shipping code in the early open-source web.
Threat Briefing: Critical GitLab RCE, Check Point VPN & WP Auth Bypass (9.8)
1. Infrastructure & Server Layer: Critical Remote Code Execution
Infrastructure teams must address immediate exploitation of dev-ops tooling and critical perimeter security updates for VPN appliances.
-
GitLab Active Exploitation — Threat actors began mass-exploiting a newly patched vulnerability within 24 hours of disclosure; RCE risk is high [2].
- CVE / severity: Not explicitly named in snippet (WatchTowr warning) / Critical.
- Affected versions: All versions prior to the latest security release (17.3.x/17.2.x/17.1.x).
- Fixed in: GitLab 17.3.2, 17.2.5, and 17.1.7.
- Action now: Update GitLab instances immediately via
apt-get install gitlab-eeoryum install gitlab-ee; restrict access to the GitLab web interface to known IPs.
-
Check Point VPN RCE — Critical vulnerabilities in VPN gateway firmware allow remote attackers to execute arbitrary code [9].
- CVE / severity: CVE-2026-85102 & CVE-2026-85103 / Critical.
- Affected versions: Check Point Quantum Security Gateway (Multiple versions).
- Fixed in: Check Point R81.20, R81.10, R80.40 Jumbo Hotfix Accumulator (specific takes).
- Action now: Apply the latest Jumbo Hotfix Accumulator via Gaia Portal or CPUSE; audit VPN session logs for unusual source IPs.
2. WordPress: Critical Account Takeovers & File Uploads
High-impact vulnerabilities in niche and utility plugins currently allow for full site compromise through authentication bypass and unrestricted uploads.
-
Advanced Customized Prompts Auth Bypass — A critical flaw allows unauthenticated users to bypass security and take over administrative accounts [6].
- CVE / severity: CVE-2026-14563 / 9.8 (Critical).
- Affected versions: Through 1.0.1.
- Fixed in: Not disclosed in sources; recommended to deactivate/delete plugin if version > 1.0.1 is not available.
- Action now:
wp plugin deactivate advanced-customized-prompts.
-
Import Products for WooCommerce Arbitrary File Upload — Missing validation in the
mipl_wc_upload_filefunction allows attackers to upload executable scripts [10].- CVE / severity: CVE-2026-8778 / Critical.
- Affected versions: All versions up to 1.0.5.
- Fixed in: Not disclosed in sources.
- Action now: Remove plugin until a patch is confirmed; monitor
/wp-content/uploads/for unexpected.phpfiles.
3. CMS Security Research: Automated Fuzzing Breakthrough
- THEMIS Fuzzing Tool — Researchers have released THEMIS, a tool that identified 10 previously unknown (0-day) vulnerabilities in popular WordPress plugins [1]. Hosting providers should prepare for a wave of new CVEs as these disclosures go public in the coming days.
4. Plugin XSS & Data Integrity Alerts
Agencies should audit the following plugins for Stored XSS, which can be used to inject malicious scripts into the admin dashboard [4][5][7].
- Media Library Assistant: CVE-2026-6640 & CVE-2026-6641. Affected: Versions up to 3.35. Action: Update to latest version.
- Featured Image with URL: CVE-2026-86780. Affected: All versions up to latest. Action: Audit image attribute values for
<script>tags. - Teddy Bear Customize Addon: CVE-2026-14562. Affected: Versions through 1.0.5. Action: Remove plugin due to authorization failure [3].
On the
road.
Conferences, summits, and WordCamps I’ll be at in the months ahead.
- Aug 16 – 19, 2026
- Sep 28 – 29, 2026
- Domain Days DubaiRescheduled
New dates to be announced.
Oct 15 – 16, 2026 - Nov 11 – 12, 2026
- State of the WordDec 2026
- Mar 15 – 18, 2027
When the servers
go quiet.
A small digital label putting out industrial house, progressive house, and dubstep. A different kind of open protocol.
Twenty years of showing up for the projects, communities, and voices that keep the open web open.
A news portal covering the hosting and domain industry — and a running excuse to keep talking to the people who build it.