Jason Nickerson — Hosting Industry InsiderTwo decades
inside the web
as it kept rewriting
itself.
I’m Jason, a hosting industry insider with experience across open-source CMS platforms, control panels, cloud infrastructure, and the events that bring the industry together. Today, I focus on building partnerships, programming industry summits, and documenting what is happening across the hosting ecosystem.
- Aug 23, 2026
Harvard is Scaling the Ivory Tower with Avatars
Harvard’s new startup bootcamp replaces human friction with AI avatars, proving that even the most prestigious institutions are ready to automate the mentorship experience.
Read article: Harvard is Scaling the Ivory Tower with Avatars→ - Aug 22, 2026
Edge Computing Just Got a Massive Altitude Adjustment
Starcloud’s quarter-billion-dollar raise confirms that the next great infrastructure land grab isn't happening in a suburban data center park, but in low Earth orbit.
Read article: Edge Computing Just Got a Massive Altitude Adjustment→ - Aug 22, 2026
The Infinite Loop of the 9.8 Critical Patch
WordPress security remains a game of whack-a-mole where a single form builder vulnerability can expose over 600,000 sites to unauthenticated PHP uploads.
Read article: The Infinite Loop of the 9.8 Critical Patch→
The early 2000s were the good years for tinkerers. Open-source CMS platforms were the closest thing we had to a universal starter kit, and PHP-Nuke and osCommerce were how you learned to ship real projects on the open web. I went deep on Joomla for the better part of a decade, contributing code to the project, organizing its community around releases and events, and eventually crossing over into the WordPress orbit that quietly swallowed everything in its path.
From there the story is a tour of the hosting stack: cPanel and the control-panel era that defined shared hosting, the managed cloud wave at Cloudways and DigitalOcean, and the publishing side at webhosting.today. Day to day now I'm at JetBackup, working on backup and disaster recovery and helping hosts protect the infrastructure that keeps everything running. I also program the seasonal industry summits, Atlas Digital Summit and Domain Days Dubai, where the hosting community gathers to set the agenda for what comes next.
The through-line is community, the conferences, the hallway conversations, and the group chats where the industry actually decides what happens next. The technology changes; the people pointing it in the right direction stay the same.
Twenty-something years,
in reverse.
- 2026 – present
FounderAtlas Digital SummitPrivate gatherings for hosting leaders, AI infrastructure innovators, and the builders of the agentic web.
- 2026 – presentFounderConf64
The Conference Operating System for Business Development and Field Marketing Teams.
- 2026 – present
Co-FounderSuperDeployThe advanced migration engine for AI applications. Seamlessly transition your codebase to independent, production-grade infrastructure in minutes.
- 2025 – 2026Director of Business Developmentwebhosting.today
Contract · Business development and partnerships for the hosting publisher.
- 2024 – presentBusiness Development & Partnerships ManagerJetBackup
Backup and disaster recovery for the hosting ecosystem.
- 2023 – present
Chief Marketing Officer, Founding TeamDomain Days DubaiMENA’s domain and digital asset conference.
- 2021 – 2023Senior Manager, WordPress Business Unit → Lead Community Marketing Manager IICloudways / DigitalOcean
Full-time · WordPress community, field marketing, and sales enablement through the acquisition.
- 2019 – 2021Marketing ManagercPanel
Full-time · Event planner and marketing strategist for 500–3,000 attendee events and virtual series.
- 2017 – 2019FounderCMS Summit
The global CMS conference.
- 2007 – 2019CEO | FounderJoomlaxtc.com / Monev Software LLC
Premium Joomla templates and extensions. 101,000+ members.
- 2015 – 2019Board Member, Capital Team ChairJoomla! Project
Leadership, sponsorships, and partnerships for the open-source CMS.
- 2001 – 2005DeveloperPHP-Nuke · osCommerce era
First shipping code in the early open-source web.
Threat Briefing: WordPress Core RCE/XSS, Mailgun SSRF & Zimbra Infrastructure Exploits
🚨 CRITICAL CORE & INFRASTRUCTURE ALERTS
WordPress Core Unauthenticated RCE — Attackers are exploiting an interpretation conflict to gain full remote code execution on outdated WordPress installations [5].
- CVE / Severity: CVE-2026-63030 | CVSS 9.8 (Critical)
- Affected versions: WordPress Core < 6.9.5
- Fixed in: WordPress 6.9.5
- Action now: Run
wp core update --version=6.9.5immediately; ensure auto-updates for minor security releases are enabled.
Zimbra Collaboration Suite Active Exploitation — Global infrastructure teams report active exploitation of a high-severity flaw allowing unauthenticated remote attackers to compromise email servers [12].
- CVE / Severity: Not disclosed in sources | High Severity
- Affected versions: All unpatched Zimbra Collaboration Suite versions
- Fixed in: Latest security patch (refer to vendor)
- Action now: Apply the latest Zimbra security updates immediately; check mail logs for unauthorized administrative access or unusual outbound traffic.
WordPress Core "XSS2Shell" Exposure — A pre-authentication cross-site scripting flaw in the login screen can be escalated to full PHP code execution [1].
- CVE / Severity: CVE-2026-64638 | CVSS 8.9 (High)
- Affected versions: WordPress Core (versions not specified in source)
- Fixed in: Refer to latest WordPress security release
- Action now: Restrict access to
wp-login.phpvia IP allow-listing or basic auth at the Nginx/Apache level until patched.
📦 PLUGIN VULNERABILITIES & EXPLOITS
Mailgun for WordPress SSRF — A path traversal flaw allows Server-Side Request Forgery, potentially exposing internal infrastructure services [2], [7].
- CVE / Severity: CVE-2026-78003 | High Severity
- Affected versions: <= 2.2.0
- Fixed in: Not disclosed in sources; update to latest available version
- Action now:
wp plugin update mailgun; disable the plugin if not actively used for SMTP routing.
WS Form LITE PHP Object Injection — A critical deserialization flaw allows attackers to inject malicious PHP objects, leading to site takeover [6], [9].
- CVE / Severity: CVE-2026-4703 | CVSS 9.8 (Critical)
- Affected versions: WS Form LITE (versions not specified in source)
- Fixed in: Refer to latest developer patch
- Action now: Update WS Form LITE immediately; scan
wp-content/uploadsfor suspicious.phpfiles created via deserialization payloads.
Elementor Stored XSS — Authenticated users with Contributor+ roles can inject malicious scripts into pages [5].
- CVE / Severity: CVE-2026-41027 | Medium Severity
- Affected versions: < 3.29.1
- Fixed in: 3.29.1
- Action now:
wp plugin update elementor; audit recent page revisions for scripts injected by low-level users.
🌐 INFRASTRUCTURE & BOTNET ACTIVITY
StopAndProtect Crime Ring — Researchers discovered a global network of 2,000+ compromised WordPress sites running criminal infrastructure. Attackers target outdated versions to host C2 nodes and DNS redirection schemes [11].
- Action now: Audit all hosted sites for "abandoned" status; use
wp-clito automate scans for outdated core/plugins across all local webroots.
FiboSearch Data Leak — The AJAX endpoint in FiboSearch exposes metadata and content of password-protected products to unauthenticated users [4].
- CVE / Severity: CVE-2026-16612 | Medium/High
- Affected versions: < 1.34.1
- Fixed in: 1.34.1
- Action now:
wp plugin update ajax-search-for-woocommerce; check if sensitive internal product pricing or data was exposed.
On the
road.
Conferences, summits, and WordCamps I’ll be at in the months ahead.
- Aug 16 – 19, 2026
- Sep 28 – 29, 2026
- Domain Days DubaiRescheduled
New dates to be announced.
Oct 15 – 16, 2026 - Nov 11 – 12, 2026
- State of the WordDec 2026
- Mar 15 – 18, 2027
When the servers
go quiet.
A small digital label putting out industrial house, progressive house, and dubstep. A different kind of open protocol.
Twenty years of showing up for the projects, communities, and voices that keep the open web open.
A news portal covering the hosting and domain industry — and a running excuse to keep talking to the people who build it.