Jason Nickerson — Hosting Industry InsiderTwo decades
inside the web
as it kept rewriting
itself.
I’m Jason, a hosting industry insider with experience across open-source CMS platforms, control panels, cloud infrastructure, and the events that bring the industry together. Today, I focus on building partnerships, programming industry summits, and documenting what is happening across the hosting ecosystem.
- Oct 26, 2026
Efficiency Over Art: The AI Content Mill Grinds On
Grok's seven-minute AI-generated film preview marks a technical milestone, but it raises serious questions about the future of creative value in a world of infinite, automated output.
Read article: Efficiency Over Art: The AI Content Mill Grinds On→ - Oct 26, 2026
Team.blue buys a few more years of runway
Moving a billion Euros down the road isn't just accounting—it's a signal that the European hosting roll-up isn't planning to slow down its acquisition spree anytime soon.
Read article: Team.blue buys a few more years of runway→ - Oct 25, 2026
The Danger of a Single Point of Failure in Geopolitics
When the backbone of a nation's communication rests in one man's hands, the word 'redundancy' takes on an entirely new meaning.
Read article: The Danger of a Single Point of Failure in Geopolitics→
The early 2000s were the good years for tinkerers. Open-source CMS platforms were the closest thing we had to a universal starter kit, and PHP-Nuke and osCommerce were how you learned to ship real projects on the open web. I went deep on Joomla for the better part of a decade, contributing code to the project, organizing its community around releases and events, and eventually crossing over into the WordPress orbit that quietly swallowed everything in its path.
From there the story is a tour of the hosting stack: cPanel and the control-panel era that defined shared hosting, the managed cloud wave at Cloudways and DigitalOcean, and the publishing side at webhosting.today. Day to day now I'm at JetBackup, working on backup and disaster recovery and helping hosts protect the infrastructure that keeps everything running. I also program the seasonal industry summits, Atlas Digital Summit and Domain Days Dubai, where the hosting community gathers to set the agenda for what comes next.
The through-line is community, the conferences, the hallway conversations, and the group chats where the industry actually decides what happens next. The technology changes; the people pointing it in the right direction stay the same.
Twenty-something years,
in reverse.
- 2026 – present
FounderAtlas Digital SummitPrivate gatherings for hosting leaders, AI infrastructure innovators, and the builders of the agentic web.
- 2026 – presentFounderConf64
The Conference Operating System for Business Development and Field Marketing Teams.
- 2026 – present
Co-FounderSuperDeployThe advanced migration engine for AI applications. Seamlessly transition your codebase to independent, production-grade infrastructure in minutes.
- 2025 – 2026Director of Business Developmentwebhosting.today
Contract · Business development and partnerships for the hosting publisher.
- 2024 – presentBusiness Development & Partnerships ManagerJetBackup
Backup and disaster recovery for the hosting ecosystem.
- 2023 – present
Chief Marketing Officer, Founding TeamDomain Days DubaiMENA’s domain and digital asset conference.
- 2021 – 2023Senior Manager, WordPress Business Unit → Lead Community Marketing Manager IICloudways / DigitalOcean
Full-time · WordPress community, field marketing, and sales enablement through the acquisition.
- 2019 – 2021Marketing ManagercPanel
Full-time · Event planner and marketing strategist for 500–3,000 attendee events and virtual series.
- 2017 – 2019FounderCMS Summit
The global CMS conference.
- 2007 – 2019CEO | FounderJoomlaxtc.com / Monev Software LLC
Premium Joomla templates and extensions. 101,000+ members.
- 2015 – 2019Board Member, Capital Team ChairJoomla! Project
Leadership, sponsorships, and partnerships for the open-source CMS.
- 2001 – 2005DeveloperPHP-Nuke · osCommerce era
First shipping code in the early open-source web.
Threat Briefing: PHP2Shell Active Exploits, OVHcloud CLI Malware & Hosting VPS Breaches
🚨 TOP PRIORITY: PHP2Shell RCE Active Exploitation
Technical analysis now confirms that one of the two "PHP2Shell" vulnerabilities is a Use-After-Free (UAF) that crosses requests, meaning a single malicious request can poison the PHP worker for subsequent legitimate users [4, 5]. While CISA has not yet added these to the KEV, security researchers report active exploitation in the wild targeting hosting environments [2, 3].
- PHP2Shell (UAF & Buffer Overflow) — Critical Unauthenticated RCE
- CVE / severity: CVE-2026-109618 and CVE-2026-109619 | CVSS 9.2 [2, 5]
- Affected versions: PHP 8.2.x < 8.2.35, 8.3.x < 8.3.36, 8.4.x < 8.4.27, 8.5.x < 8.5.12 [5]
- Fixed in: PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12 [5]
- Action now:
- Upgrade PHP immediately:
dnf upgrade phporapt-get install --only-upgrade php-fpm. - If patching is impossible, some agencies recommend taking high-risk sites offline temporarily [7].
- Restart PHP-FPM and Web Server services (Nginx/Apache) to clear potentially poisoned worker processes [4].
- Upgrade PHP immediately:
🌐 INFRASTRUCTURE & HOSTING ALERTS
Recent incidents target the supply chain and virtualization layers of major hosting providers. A significant breach involves the tampering of open-source CLI tools to deliver malware to infrastructure admins [6].
-
OVHcloud CLI Supply Chain Attack — Malware injection via official CLI tool
- CVE / severity: No CVE assigned | Critical Impact [6]
- Affected versions: OVHcloud open-source CLI (Tampered versions) [6]
- Fixed in: Use latest verified version from official repositories only.
- Action now:
- Inspect environments for unauthorized CLI installations.
- Rotate all OVHcloud API keys and customer credentials immediately [6].
-
Onamae Desktop Cloud (GMO Internet) VPS Breach — Malware injection into customer servers
- CVE / severity: No CVE assigned | Infrastructure Breach [8]
- Affected versions: All Onamae.com Desktop Cloud VPS instances [8]
- Fixed in: Infrastructure-side isolation ongoing.
- Action now:
- Run full malware scans on all Windows/Desktop VPS instances hosted with GMO Internet.
- Check for unauthorized startup programs or scheduled tasks [8].
🛠️ CONTROL PANEL & SERVER STACK
Hosting panels are primary targets for the PHP2Shell flaws due to their reliance on specific PHP versions for management interfaces [10].
- cPanel & WHM PHP2Shell Vulnerability — RCE via management interface
- CVE / severity: CVE-2026-109618 / 109619 | CVSS 9.2 [10]
- Affected versions: 11.110.0.153, 11.134.0.66, 11.136.0.50, 11.138.0.18 [10]
- Fixed in: cPanel & WHM Tier-specific security releases (check
/usr/local/cpanel/cpanel -V) [10] - Action now:
- Run
/scripts/upcpto force the latest security build. - Ensure "EasyApache 4" PHP packages are updated to the versions listed in the PHP section above.
- Run
📦 WORDPRESS & APP LAYER
Beyond core PHP flaws, cross-request vulnerabilities are being used to compromise session data and runtime chains [4].
- Java VM / Oracle CPU Critical Update — Unauthorized data modification
- CVE / severity: Multiple (Oct 2026 CPU) | Critical [14]
- Affected versions: Oracle Java SE, multiple versions including 8u421, 11.0.24, 17.0.12 [14]
- Fixed in: October 2024 Critical Patch Update versions [14]
- Action now:
- Update server-side Java environments used for search (Solr/Elasticsearch) or specialized CMS backends.
- Verify integrity of critical data for unauthorized modifications [14].
On the
road.
Conferences, summits, and WordCamps I’ll be at in the months ahead.
- Nov 11 – 12, 2026
- State of the WordDec 2026
- Mar 15 – 18, 2027
When the servers
go quiet.
A small digital label putting out industrial house, progressive house, and dubstep. A different kind of open protocol.
Twenty years of showing up for the projects, communities, and voices that keep the open web open.
A news portal covering the hosting and domain industry — and a running excuse to keep talking to the people who build it.