Jason Nickerson — Hosting Industry InsiderTwo decades
inside the web
as it kept rewriting
itself.
I’m Jason, a hosting industry insider with experience across open-source CMS platforms, control panels, cloud infrastructure, and the events that bring the industry together. Today, I focus on building partnerships, programming industry summits, and documenting what is happening across the hosting ecosystem.
- Oct 8, 2026
Hermes and the $1.5 Billion Question
Nous Research just hit unicorn status with a $90M Series B, proving that the market for specialized AI agents is moving far beyond the chatbot phase.
Read article: Hermes and the $1.5 Billion Question→ - Oct 8, 2026
The Administrative Trojan Horse in Your Inbox
Attackers are currently exploiting XSS vulnerabilities in Ninja Forms and WooCommerce to hijack admin sessions and install persistent backdoors on WordPress sites.
Read article: The Administrative Trojan Horse in Your Inbox→ - Oct 7, 2026
Tab and the $300 Million Question of Privacy
A new personal AI assistant called Tab has emerged from stealth with a massive valuation, proving that the dream of a digital second brain is still attracting serious capital.
Read article: Tab and the $300 Million Question of Privacy→
The early 2000s were the good years for tinkerers. Open-source CMS platforms were the closest thing we had to a universal starter kit, and PHP-Nuke and osCommerce were how you learned to ship real projects on the open web. I went deep on Joomla for the better part of a decade, contributing code to the project, organizing its community around releases and events, and eventually crossing over into the WordPress orbit that quietly swallowed everything in its path.
From there the story is a tour of the hosting stack: cPanel and the control-panel era that defined shared hosting, the managed cloud wave at Cloudways and DigitalOcean, and the publishing side at webhosting.today. Day to day now I'm at JetBackup, working on backup and disaster recovery and helping hosts protect the infrastructure that keeps everything running. I also program the seasonal industry summits, Atlas Digital Summit and Domain Days Dubai, where the hosting community gathers to set the agenda for what comes next.
The through-line is community, the conferences, the hallway conversations, and the group chats where the industry actually decides what happens next. The technology changes; the people pointing it in the right direction stay the same.
Twenty-something years,
in reverse.
- 2026 – present
FounderAtlas Digital SummitPrivate gatherings for hosting leaders, AI infrastructure innovators, and the builders of the agentic web.
- 2026 – presentFounderConf64
The Conference Operating System for Business Development and Field Marketing Teams.
- 2026 – present
Co-FounderSuperDeployThe advanced migration engine for AI applications. Seamlessly transition your codebase to independent, production-grade infrastructure in minutes.
- 2025 – 2026Director of Business Developmentwebhosting.today
Contract · Business development and partnerships for the hosting publisher.
- 2024 – presentBusiness Development & Partnerships ManagerJetBackup
Backup and disaster recovery for the hosting ecosystem.
- 2023 – present
Chief Marketing Officer, Founding TeamDomain Days DubaiMENA’s domain and digital asset conference.
- 2021 – 2023Senior Manager, WordPress Business Unit → Lead Community Marketing Manager IICloudways / DigitalOcean
Full-time · WordPress community, field marketing, and sales enablement through the acquisition.
- 2019 – 2021Marketing ManagercPanel
Full-time · Event planner and marketing strategist for 500–3,000 attendee events and virtual series.
- 2017 – 2019FounderCMS Summit
The global CMS conference.
- 2007 – 2019CEO | FounderJoomlaxtc.com / Monev Software LLC
Premium Joomla templates and extensions. 101,000+ members.
- 2015 – 2019Board Member, Capital Team ChairJoomla! Project
Leadership, sponsorships, and partnerships for the open-source CMS.
- 2001 – 2005DeveloperPHP-Nuke · osCommerce era
First shipping code in the early open-source web.
Threat Briefing: WordPress Path Traversal RCE, SQLi Exploits & Infrastructure Malware Defense
🚨 Critical WordPress & CMS Vulnerabilities
WordPress Path Traversal to RCE (CVE-2026-87902) — Critical vulnerability allowing unauthenticated attackers to read local files and potentially achieve remote code execution (RCE) via path traversal. Active exploitation attempts were observed within 5 hours of patch release [1][6].
- CVE / severity: CVE-2026-87902 | Critical
- Affected versions: WordPress Core < 7.1.3
- Fixed in: WordPress 7.1.3 [2]
- Action now: Run
wp core updateimmediately; ensure automatic background updates are enabled for security releases.
Newsletter Subscription Form SQL Injection — A critical SQLi flaw in this plugin enables unauthenticated database access, potentially leading to credential theft or full site takeover [9].
- CVE / severity: CVE-2026-41555 | 9.3 Critical
- Affected versions: Newsletter Subscription Form <= 1.5.9
- Fixed in: Not disclosed in sources; update to latest version or deactivate plugin.
- Action now:
wp plugin update newsletter-subscription-form-user-subscriptions-form-capture-email; monitor SQL logs for unusual query patterns.
The Events Calendar Object Injection — Deserialization of untrusted data allowing attackers to inject PHP objects and compromise site integrity [7].
- CVE / severity: CVE-2026-95606 | High (CVSS Not disclosed in sources)
- Affected versions: The Events Calendar (StellarWP) - Specific versions not disclosed in sources
- Fixed in: Latest available version
- Action now:
wp plugin update the-events-calendar; audit for suspiciouswp_optionsmodifications.
🛡️ Hosting & Infrastructure Security Developments
HostGator LATAM Malware Defense Integration — Significant infrastructure-wide rollout of "Gator Protect" to 600,000 customers. This indicates a shifting baseline for hosting providers toward integrated, automated malware scanning and mitigation at the server level rather than relying on user-land CMS plugins [10].
- Impact: Managed hosting providers should evaluate if their current server-side scanning (e.g., Imunify360, Monarx) covers the recent surge in automated RCE attempts [6][10].
Unauthenticated Backup Data Exposure (SafeSnap) — Verified WordPress backup plugin exposes sensitive archive data without authentication, putting entire server-side database dumps at risk [9].
- CVE / severity: CVE-2026-41559 | 7.5 High
- Affected versions: SafeSnap <= 2.1.2
- Fixed in: Not disclosed in sources
- Action now: Deactivate plugin until patched; check backup directories for world-readable permissions and rotate database credentials.
📦 Plugin & Add-on Vulnerability Updates
- Chartify LFI (CVE-2024-10571): Local File Inclusion in versions up to 2.9.5. Action: Update to 2.9.6 or later immediately [8].
- Hustle Popups (CVE-2026-103075): Missing authorization in WPMU DEV plugin allows unauthorized security level changes. Action: Update to latest version via WPMU DEV dashboard [4].
- Elementor Blog Filter (CVE-2026-40806): Unauthenticated XSS in versions <= 2.1.0. Action: Update plugin to sanitize post-category filtering [9].
On the
road.
Conferences, summits, and WordCamps I’ll be at in the months ahead.
- Aug 16 – 19, 2026
- Sep 28 – 29, 2026
- Domain Days DubaiRescheduled
New dates to be announced.
Oct 15 – 16, 2026 - Nov 11 – 12, 2026
- State of the WordDec 2026
- Mar 15 – 18, 2027
When the servers
go quiet.
A small digital label putting out industrial house, progressive house, and dubstep. A different kind of open protocol.
Twenty years of showing up for the projects, communities, and voices that keep the open web open.
A news portal covering the hosting and domain industry — and a running excuse to keep talking to the people who build it.