Jason Nickerson — Hosting Industry InsiderTwo decades
inside the web
as it kept rewriting
itself.
I’m Jason, a hosting industry insider with experience across open-source CMS platforms, control panels, cloud infrastructure, and the events that bring the industry together. Today, I focus on building partnerships, programming industry summits, and documenting what is happening across the hosting ecosystem.
- Oct 31, 2026
The High Price of Training God-Bots
Anthropic's potential 'junk' credit rating highlights the growing tension between massive AI compute costs and the harsh realities of public market balance sheets.
Read article: The High Price of Training God-Bots→ - Oct 31, 2026
When the AI Starts Writing the Zero-Days
A new Linux TCP exploit generated by Claude shows that the gap between a patch and a remote root exploit is closing faster than our release cycles can handle.
Read article: When the AI Starts Writing the Zero-Days→ - Oct 30, 2026
Sam Altman Wants to Watch Your Front Door
OpenAI-backed Thrive Holdings is dropping $15.3 billion to buy ADT, signaling a massive shift from simple home security to AI-integrated physical infrastructure.
Read article: Sam Altman Wants to Watch Your Front Door→
The early 2000s were the good years for tinkerers. Open-source CMS platforms were the closest thing we had to a universal starter kit, and PHP-Nuke and osCommerce were how you learned to ship real projects on the open web. I went deep on Joomla for the better part of a decade, contributing code to the project, organizing its community around releases and events, and eventually crossing over into the WordPress orbit that quietly swallowed everything in its path.
From there the story is a tour of the hosting stack: cPanel and the control-panel era that defined shared hosting, the managed cloud wave at Cloudways and DigitalOcean, and the publishing side at webhosting.today. Day to day now I'm at JetBackup, working on backup and disaster recovery and helping hosts protect the infrastructure that keeps everything running. I also program the seasonal industry summits, Atlas Digital Summit and Domain Days Dubai, where the hosting community gathers to set the agenda for what comes next.
The through-line is community, the conferences, the hallway conversations, and the group chats where the industry actually decides what happens next. The technology changes; the people pointing it in the right direction stay the same.
Twenty-something years,
in reverse.
- 2026 – present
FounderAtlas Digital SummitPrivate gatherings for hosting leaders, AI infrastructure innovators, and the builders of the agentic web.
- 2026 – presentFounderConf64
The Conference Operating System for Business Development and Field Marketing Teams.
- 2026 – present
Co-FounderSuperDeployThe advanced migration engine for AI applications. Seamlessly transition your codebase to independent, production-grade infrastructure in minutes.
- 2025 – 2026Director of Business Developmentwebhosting.today
Contract · Business development and partnerships for the hosting publisher.
- 2024 – presentBusiness Development & Partnerships ManagerJetBackup
Backup and disaster recovery for the hosting ecosystem.
- 2023 – present
Chief Marketing Officer, Founding TeamDomain Days DubaiMENA’s domain and digital asset conference.
- 2021 – 2023Senior Manager, WordPress Business Unit → Lead Community Marketing Manager IICloudways / DigitalOcean
Full-time · WordPress community, field marketing, and sales enablement through the acquisition.
- 2019 – 2021Marketing ManagercPanel
Full-time · Event planner and marketing strategist for 500–3,000 attendee events and virtual series.
- 2017 – 2019FounderCMS Summit
The global CMS conference.
- 2007 – 2019CEO | FounderJoomlaxtc.com / Monev Software LLC
Premium Joomla templates and extensions. 101,000+ members.
- 2015 – 2019Board Member, Capital Team ChairJoomla! Project
Leadership, sponsorships, and partnerships for the open-source CMS.
- 2001 – 2005DeveloperPHP-Nuke · osCommerce era
First shipping code in the early open-source web.
Threat Briefing: WordPress 7.1.4 RCE, Northflank Secret Breach & Traefik CVE
1. INFRASTRUCTURE & HOSTING ALERTS
Northflank Platform Breach — Unauthorized access to customer secrets and API keys [10].
- CVE / severity: No CVE assigned / Critical
- Affected versions: All Northflank platform accounts and stored environment variables.
- Fixed in: Access vector mitigated; rotations required.
- Action now: Rotate all credentials, API keys (especially AI provider keys), and secrets stored on the platform immediately. Check for unauthorized API usage in billing logs [10].
Traefik Proxy Request Handling Vulnerability — Risk of unauthorized traffic routing or disruption [14].
- CVE / severity: CVE-2026-119573 / CVSS 4.4 (Medium)
- Affected versions: Traefik Proxy versions prior to 3.7.15.
- Fixed in: Traefik 3.7.15 [14].
- Action now: Upgrade to version 3.7.15 using
docker pull traefik:v3.7.15or your relevant package manager. Audit dynamic configuration files for unexpected entry points [14].
PHP2Shell Residual Risk — Ongoing exploitation of recent PHP RCE flaws on hosting handlers [13].
- CVE / severity: Multiple (PHP RCE) / Critical
- Affected versions: Unpatched PHP handlers (FPM, FastCGI) on Plesk, cPanel, and Docker [13].
- Fixed in: Latest PHP 8.x/7.x security releases; Plesk/cPanel handler updates [13].
- Action now: Plesk users must run
plesk installer --select-release-current --reinstall-patch. WHM users should run/scripts/upcpand ensureEasyApache 4is fully updated [13].
2. WORDPRESS CORE & PLUGIN CRITICALS
WordPress 7.1.4 Security Release — Fixes 22 vulnerabilities including Unauthenticated RCE [2][3].
- CVE / severity: Multiple IDs including RCE / Critical
- Affected versions: WordPress Core < 7.1.4.
- Fixed in: WordPress 7.1.4 [2].
- Action now: Update via Dashboard or
wp core update. This release addresses a critical flaw in the core update process that allowed code execution [3].
LeadSnap Plugin PHP Object Injection — Deserialization flaw allowing potential RCE [4].
- CVE / severity: CVE-2026-90888 / High
- Affected versions: LeadSnap WordPress plugin <= 1.25.
- Fixed in: Not disclosed in sources (Patch recommended: 1.26 or higher if available) [4].
- Action now: Deactivate plugin immediately if on version 1.25 or lower until a confirmed patch is applied. Monitor logs for
CWE-502attack patterns [4].
Plugin Vulnerability Roundup — File deletion and unauthorized uploads [5][6][1].
- CVE-2026-103882 (Acadlix LMS): Arbitrary file deletion flaw. Action: Update to latest version [5].
- CVE-2026-118235 (Plugin/NVD): Unauthenticated file upload leading to RCE. Action: Identify plugin and apply latest vendor patch [6].
- CVE-2026-113481 (Media Library Assistant): Information disclosure via unauthorized post viewing. Fixed in: 3.44. Action:
wp plugin update media-library-assistant[1].
3. DATABASE & SUPPLY CHAIN
MariaDB 10.6 End-of-Life Warning — Security support shifting; upgrade path critical for infrastructure stability [7].
- Context: Following last week's PHP emergency patches, database security is now the primary focus for fleet maintenance [7].
- Action now: Transition production environments from MariaDB 10.6 to 10.11 (LTS) or 11.x to ensure continued receipt of security patches [7].
GitHub/Gmail Targeted Credential Attacks — Cluster of developers reporting unauthorized Gmail access attempts tied to GitHub activity [12].
- Action now: Infrastructure teams should mandate hardware-based 2FA (YubiKey/FIDO2) for all GitHub organization members and enforce session timeouts [12].
On the
road.
Conferences, summits, and WordCamps I’ll be at in the months ahead.
- Nov 11 – 12, 2026
- State of the WordDec 2026
- Mar 15 – 18, 2027
When the servers
go quiet.
A small digital label putting out industrial house, progressive house, and dubstep. A different kind of open protocol.
Twenty years of showing up for the projects, communities, and voices that keep the open web open.
A news portal covering the hosting and domain industry — and a running excuse to keep talking to the people who build it.