Jason Nickerson — Hosting Industry InsiderTwo decades
inside the web
as it kept rewriting
itself.
I’m Jason, a hosting industry insider with experience across open-source CMS platforms, control panels, cloud infrastructure, and the events that bring the industry together. Today, I focus on building partnerships, programming industry summits, and documenting what is happening across the hosting ecosystem.
- Nov 10, 2026
Uber Wants the Driveway, Not Just the Ride
Uber's acquisition of SpotHero and its move into the parking sector is a calculated play for the infrastructure of the autonomous future.
Read article: Uber Wants the Driveway, Not Just the Ride→ - Nov 10, 2026
Academia Finally Discovers the Open Source Internship
WordPress Credits just hit a major milestone with 50 institutions, turning open-source contributions into actual academic currency for students globally.
Read article: Academia Finally Discovers the Open Source Internship→ - Nov 10, 2026
When a Local UDP Flaw Stops Being a Hobbyist Nuisance
A recent exploit on a CloudLinux 8 server shows how a 'simple' crash-inducing bug can quickly evolve into a full-scale root access threat in a multi-tenant environment.
Read article: When a Local UDP Flaw Stops Being a Hobbyist Nuisance→
The early 2000s were the good years for tinkerers. Open-source CMS platforms were the closest thing we had to a universal starter kit, and PHP-Nuke and osCommerce were how you learned to ship real projects on the open web. I went deep on Joomla for the better part of a decade, contributing code to the project, organizing its community around releases and events, and eventually crossing over into the WordPress orbit that quietly swallowed everything in its path.
From there the story is a tour of the hosting stack: cPanel and the control-panel era that defined shared hosting, the managed cloud wave at Cloudways and DigitalOcean, and the publishing side at webhosting.today. Day to day now I'm at JetBackup, working on backup and disaster recovery and helping hosts protect the infrastructure that keeps everything running. I also program the seasonal industry summits, Atlas Digital Summit and Domain Days Dubai, where the hosting community gathers to set the agenda for what comes next.
The through-line is community, the conferences, the hallway conversations, and the group chats where the industry actually decides what happens next. The technology changes; the people pointing it in the right direction stay the same.
Twenty-something years,
in reverse.
- 2026 – present
FounderAtlas Digital SummitPrivate gatherings for hosting leaders, AI infrastructure innovators, and the builders of the agentic web.
- 2026 – presentFounderConf64
The Conference Operating System for Business Development and Field Marketing Teams.
- 2026 – present
Co-FounderSuperDeployThe advanced migration engine for AI applications. Seamlessly transition your codebase to independent, production-grade infrastructure in minutes.
- 2025 – 2026Director of Business Developmentwebhosting.today
Contract · Business development and partnerships for the hosting publisher.
- 2024 – presentBusiness Development & Partnerships ManagerJetBackup
Backup and disaster recovery for the hosting ecosystem.
- 2023 – present
Chief Marketing Officer, Founding TeamDomain Days DubaiMENA’s domain and digital asset conference.
- 2021 – 2023Senior Manager, WordPress Business Unit → Lead Community Marketing Manager IICloudways / DigitalOcean
Full-time · WordPress community, field marketing, and sales enablement through the acquisition.
- 2019 – 2021Marketing ManagercPanel
Full-time · Event planner and marketing strategist for 500–3,000 attendee events and virtual series.
- 2017 – 2019FounderCMS Summit
The global CMS conference.
- 2007 – 2019CEO | FounderJoomlaxtc.com / Monev Software LLC
Premium Joomla templates and extensions. 101,000+ members.
- 2015 – 2019Board Member, Capital Team ChairJoomla! Project
Leadership, sponsorships, and partnerships for the open-source CMS.
- 2001 – 2005DeveloperPHP-Nuke · osCommerce era
First shipping code in the early open-source web.
Threat Briefing: Mittwald AI-MCP Breach, cPanel Auth Bypass & Zero-Day WP Exploits
1. INFRASTRUCTURE & HOSTING: Mittwald AI Breach & cPanel Zero-Day
- Mittwald MCP Server Compromise: A German web host disclosed a breach where attackers exploited the Model Context Protocol (MCP) server used for AI assistant integration [7]. Attackers stole session tokens to impersonate users, compromising 56 customer projects. The attacker’s speed suggests AI-augmented automation [8].
- cPanel Critical Auth Bypass: An unauthenticated remote authentication bypass (CVE-2026-41940) is reportedly being exploited in the wild [11]. This allows attackers to gain unauthorized access to cPanel/WHM interfaces.
Mittwald CM Service (MCP Server)
- CVE / Severity: no CVE assigned / High
- Affected versions: All customers using MCP server interface since Oct 27, 2026
- Fixed in: MCP server disabled indefinitely; mStudio/SSH restored Nov 7
- Action now:
- Rotate all database, email, and API credentials stored in projects.
- Audit and delete unrecognized SSH keys and API keys.
- Enable Two-Factor Authentication (2FA) for all mStudio accounts.
cPanel & WHM
- CVE / Severity: CVE-2026-41940 / 9.8 (Critical)
- Affected versions: Not disclosed in sources
- Fixed in: See latest security tier updates via
/scripts/upcp - Action now:
- Update cPanel/WHM immediately:
/usr/local/cpanel/scripts/upcp. - Restrict access to WHM/cPanel ports (2083, 2087) to known admin IPs via firewall.
- Update cPanel/WHM immediately:
2. WORDPRESS & CMS: Active Zero-Day Exploitation
- WP Duplicate Zero-Day: A critical arbitrary file upload vulnerability in the "WP Duplicate" plugin (formerly LocalSync) is currently under active exploitation [2][5]. No patch is available, and the plugin has been closed by WordPress.org.
- Confection WordPress Cable RCE: This plugin fails to perform capability checks, allowing unauthenticated attackers to inject code into a PHP settings file [1][6].
WP Duplicate (formerly LocalSync)
- CVE / Severity: CVE-2026-123751 / 9.8 (Critical)
- Affected versions: All versions (including 1.0.1)
- Fixed in: No patch available; plugin closed.
- Action now:
- CRITICAL: Deactivate and DELETE the plugin immediately.
- Scan for unauthorized
.phpfiles in/wp-content/uploads/.
Confection WordPress Cable
- CVE / Severity: CVE-2026-115252 / 9.8 (Critical)
- Affected versions: 0.4.0 to 0.4.7
- Fixed in: No patch available; plugin closed.
- Action now:
- Remove the plugin from all sites.
- Block network access to the plugin's settings endpoint via WAF.
3. LINUX & LIBS: Debian Symfony Updates
- Debian Symfony Security Fixes: Multiple flaws in the Symfony framework (used by many CMS and custom PHP apps) have been patched in Debian to prevent XML External Entity (XXE) injection and data exposure [3].
Debian Symfony Packages
- CVE / Severity: DSA-6617-1 / High
- Affected versions: Symfony packages in Debian stable/oldstable
- Fixed in: Debian Security Advisory 6617-1
- Action now:
- Run
apt-get update && apt-get upgradeon impacted Debian servers. - Restart PHP-FPM or Apache services to ensure the new libraries are loaded.
- Run
On the
road.
Conferences, summits, and WordCamps I’ll be at in the months ahead.
- Nov 11 – 12, 2026
- State of the WordDec 2026
- Mar 15 – 18, 2027
When the servers
go quiet.
A small digital label putting out industrial house, progressive house, and dubstep. A different kind of open protocol.
Twenty years of showing up for the projects, communities, and voices that keep the open web open.
A news portal covering the hosting and domain industry — and a running excuse to keep talking to the people who build it.