Jason Nickerson — Hosting Industry InsiderTwo decades
inside the web
as it kept rewriting
itself.
I’m Jason, a hosting industry insider with experience across open-source CMS platforms, control panels, cloud infrastructure, and the events that bring the industry together. Today, I focus on building partnerships, programming industry summits, and documenting what is happening across the hosting ecosystem.
- Sep 23, 2026
Drop Everything: WordPress 7.1.2 and the Art of the Immediate Patch
When the security team tags a release as critical, the conversation about feature roadmaps stops. It's time to hit update and ask questions later.
Read article: Drop Everything: WordPress 7.1.2 and the Art of the Immediate Patch→ - Sep 23, 2026
When the Basement Floods: The libheif Security Gap
A deep-seated vulnerability in the libheif library proves that even a secure WordPress install is only as safe as the Linux libraries supporting it.
Read article: When the Basement Floods: The libheif Security Gap→ - Sep 19, 2026
Patch First, Debrief Later: The Reality of 7.1.1
WordPress 7.1.1 is out with 11 security fixes and nearly 40 bug patches. If you haven't checked your dashboard yet, now is the time to verify those auto-updates actually ran.
Read article: Patch First, Debrief Later: The Reality of 7.1.1→
The early 2000s were the good years for tinkerers. Open-source CMS platforms were the closest thing we had to a universal starter kit, and PHP-Nuke and osCommerce were how you learned to ship real projects on the open web. I went deep on Joomla for the better part of a decade, contributing code to the project, organizing its community around releases and events, and eventually crossing over into the WordPress orbit that quietly swallowed everything in its path.
From there the story is a tour of the hosting stack: cPanel and the control-panel era that defined shared hosting, the managed cloud wave at Cloudways and DigitalOcean, and the publishing side at webhosting.today. Day to day now I'm at JetBackup, working on backup and disaster recovery and helping hosts protect the infrastructure that keeps everything running. I also program the seasonal industry summits, Atlas Digital Summit and Domain Days Dubai, where the hosting community gathers to set the agenda for what comes next.
The through-line is community, the conferences, the hallway conversations, and the group chats where the industry actually decides what happens next. The technology changes; the people pointing it in the right direction stay the same.
Twenty-something years,
in reverse.
- 2026 – present
FounderAtlas Digital SummitPrivate gatherings for hosting leaders, AI infrastructure innovators, and the builders of the agentic web.
- 2026 – presentFounderConf64
The Conference Operating System for Business Development and Field Marketing Teams.
- 2026 – present
Co-FounderSuperDeployThe advanced migration engine for AI applications. Seamlessly transition your codebase to independent, production-grade infrastructure in minutes.
- 2025 – 2026Director of Business Developmentwebhosting.today
Contract · Business development and partnerships for the hosting publisher.
- 2024 – presentBusiness Development & Partnerships ManagerJetBackup
Backup and disaster recovery for the hosting ecosystem.
- 2023 – present
Chief Marketing Officer, Founding TeamDomain Days DubaiMENA’s domain and digital asset conference.
- 2021 – 2023Senior Manager, WordPress Business Unit → Lead Community Marketing Manager IICloudways / DigitalOcean
Full-time · WordPress community, field marketing, and sales enablement through the acquisition.
- 2019 – 2021Marketing ManagercPanel
Full-time · Event planner and marketing strategist for 500–3,000 attendee events and virtual series.
- 2017 – 2019FounderCMS Summit
The global CMS conference.
- 2007 – 2019CEO | FounderJoomlaxtc.com / Monev Software LLC
Premium Joomla templates and extensions. 101,000+ members.
- 2015 – 2019Board Member, Capital Team ChairJoomla! Project
Leadership, sponsorships, and partnerships for the open-source CMS.
- 2001 – 2005DeveloperPHP-Nuke · osCommerce era
First shipping code in the early open-source web.
Threat Briefing: WordPress Core 7.1.2 RCE, cPanel Auth Bypass & BIND DNS Vulnerabilities
⚠️ CRITICAL: WordPress Core Unauthenticated LFI to RCE
WordPress has issued an emergency security release (7.1.2) to address a critical path traversal and local PHP file inclusion (LFI) vulnerability in the page-template resolver [1][3]. An unauthenticated attacker can manipulate page requests to load arbitrary PHP files from the server, potentially leading to full Remote Code Execution (RCE) on certain configurations [4][5][11].
- CVE / severity: CVE-2026-87902 | CVSS 9.2 (Critical)
- Affected versions: WordPress Core 4.7.0 through 7.1.1 [2][11]
- Fixed in: 7.1.2 (and backported security releases for older branches)
- Action now:
- Run
wp core updateimmediately. - If using automated updates, verify the site is running 7.1.2.
- Monitor for unusual PHP execution originating from
wp-includes/template.php[11].
- Run
🛠️ Infrastructure: cPanel/WHM CalDAV Authentication Bypass
cPanel has deployed targeted patches to address a vulnerability in the CalDAV and CardDAV implementations that could impact hosting account security [6][7]. This follows recent reports of active exploits against hosting-related plugins.
- CVE / severity: CVE-2026-87899 | Severity not disclosed in sources
- Affected versions: cPanel/WHM v120 or later [7]
- Fixed in: 11.134.0.57, 11.136.0.41, 11.138.0.8, or 11.138.1.11 (WP2) [7]
- Action now:
- Execute
/scripts/upcpto update cPanel & WHM to the latest patched build. - Audit server logs for unauthorized CalDAV/CardDAV access attempts.
- Execute
🛡️ Infrastructure: BIND DNS Memory & Resource Flaws
New advisories highlight memory-safety and resource exhaustion flaws in BIND, the primary DNS software used across cPanel, WHM, and Plesk environments [10]. These flaws can lead to Denial of Service (DoS) or potential memory corruption.
- CVE / severity: No CVE assigned (listed as CERT-In weakness) [10]
- Affected versions: BIND 9.11.0–9.18.50, 9.20.0–9.20.27, 9.21.0–9.21.25 [10]
- Fixed in: Not disclosed in sources (refer to OS-specific package updates)
- Action now:
- Update BIND packages via system package manager (e.g.,
dnf update bindorapt upgrade bind9). - Restart DNS services after patching.
- Update BIND packages via system package manager (e.g.,
📦 Supply Chain & Plugin Exploitation: Brevo and Acronis
New mitigation data has been released regarding the Brevo (formerly Sendinblue) supply-chain attack that injects "ClickFix" scripts, and ongoing exploitation of the Acronis backup plugin for cPanel [8].
- Brevo Action: Block domains
cdn10.sendibt1[.]com,yelahaye[.]surf, andboiseno[.]clubat the DNS/Firewall level. Scan for a malicious plugin named "Web Media Optimizer" [8]. - Acronis CVE: CVE-2026-87886 (PrivEsc). Impacting Linux servers with Acronis Backup for cPanel (<1.9.3 HF3) or Plesk (<1.8.11) [8].
- Action now: Update Acronis to version 1.9.3 HF3 (cPanel) or 1.8.11 (Plesk). Rotate all SSH keys and API keys if a vulnerable version was present [8].
🔌 WP Plugin Vulnerabilities
- Forminator (RCE): CVE not assigned | CVSS Medium. Affected < 1.57.2.1. Action: Update to 1.57.2.1 [13].
- WPGraphQL Smart Cache (Access Control): CVE not assigned | CVSS Moderate. Affected < 2.3.2. Action: Update to 2.3.2 [12].
- Meow Gallery (Shortcode Execution): CVE not assigned | CVSS Moderate. Affected < 5.5.5. Action: Update to 5.5.5 [14].
On the
road.
Conferences, summits, and WordCamps I’ll be at in the months ahead.
- Aug 16 – 19, 2026
- Sep 28 – 29, 2026
- Domain Days DubaiRescheduled
New dates to be announced.
Oct 15 – 16, 2026 - Nov 11 – 12, 2026
- State of the WordDec 2026
- Mar 15 – 18, 2027
When the servers
go quiet.
A small digital label putting out industrial house, progressive house, and dubstep. A different kind of open protocol.
Twenty years of showing up for the projects, communities, and voices that keep the open web open.
A news portal covering the hosting and domain industry — and a running excuse to keep talking to the people who build it.