Jason Nickerson — Hosting Industry InsiderTwo decades
inside the web
as it kept rewriting
itself.
I’m Jason, a hosting industry insider with experience across open-source CMS platforms, control panels, cloud infrastructure, and the events that bring the industry together. Today, I focus on building partnerships, programming industry summits, and documenting what is happening across the hosting ecosystem.
- Aug 27, 2026
Nvidia Buys the Library: Control at the Software Layer
Nvidia's $12.9 billion acquisition of Hugging Face is less about social networking for developers and more about securing the future of where AI models actually live.
Read article: Nvidia Buys the Library: Control at the Software Layer→ - Aug 27, 2026
Why InMotion's Move Into the PHP Engine is the Right Kind of Friction
InMotion Hosting is baking security directly into the PHP engine with Monarx, signaling a shift away from bloated edge firewalls toward more efficient, code-level protection.
Read article: Why InMotion's Move Into the PHP Engine is the Right Kind of Friction→ - Aug 26, 2026
When AI Hallucinations Hit the P&L Statement
QueryStory is raising $6 million to solve the 'black box' problem in enterprise AI, proving that transparency is the next big commodity in the tech stack.
Read article: When AI Hallucinations Hit the P&L Statement→
The early 2000s were the good years for tinkerers. Open-source CMS platforms were the closest thing we had to a universal starter kit, and PHP-Nuke and osCommerce were how you learned to ship real projects on the open web. I went deep on Joomla for the better part of a decade, contributing code to the project, organizing its community around releases and events, and eventually crossing over into the WordPress orbit that quietly swallowed everything in its path.
From there the story is a tour of the hosting stack: cPanel and the control-panel era that defined shared hosting, the managed cloud wave at Cloudways and DigitalOcean, and the publishing side at webhosting.today. Day to day now I'm at JetBackup, working on backup and disaster recovery and helping hosts protect the infrastructure that keeps everything running. I also program the seasonal industry summits, Atlas Digital Summit and Domain Days Dubai, where the hosting community gathers to set the agenda for what comes next.
The through-line is community, the conferences, the hallway conversations, and the group chats where the industry actually decides what happens next. The technology changes; the people pointing it in the right direction stay the same.
Twenty-something years,
in reverse.
- 2026 – present
FounderAtlas Digital SummitPrivate gatherings for hosting leaders, AI infrastructure innovators, and the builders of the agentic web.
- 2026 – presentFounderConf64
The Conference Operating System for Business Development and Field Marketing Teams.
- 2026 – present
Co-FounderSuperDeployThe advanced migration engine for AI applications. Seamlessly transition your codebase to independent, production-grade infrastructure in minutes.
- 2025 – 2026Director of Business Developmentwebhosting.today
Contract · Business development and partnerships for the hosting publisher.
- 2024 – presentBusiness Development & Partnerships ManagerJetBackup
Backup and disaster recovery for the hosting ecosystem.
- 2023 – present
Chief Marketing Officer, Founding TeamDomain Days DubaiMENA’s domain and digital asset conference.
- 2021 – 2023Senior Manager, WordPress Business Unit → Lead Community Marketing Manager IICloudways / DigitalOcean
Full-time · WordPress community, field marketing, and sales enablement through the acquisition.
- 2019 – 2021Marketing ManagercPanel
Full-time · Event planner and marketing strategist for 500–3,000 attendee events and virtual series.
- 2017 – 2019FounderCMS Summit
The global CMS conference.
- 2007 – 2019CEO | FounderJoomlaxtc.com / Monev Software LLC
Premium Joomla templates and extensions. 101,000+ members.
- 2015 – 2019Board Member, Capital Team ChairJoomla! Project
Leadership, sponsorships, and partnerships for the open-source CMS.
- 2001 – 2005DeveloperPHP-Nuke · osCommerce era
First shipping code in the early open-source web.
Threat Briefing: cPanel Root SQL Bypass, Avada Zero-Click RCE & CyrusOne Ransomware
🚨 Infrastructure & Hosting Alerts
cPanel Database Root Privilege Escalation — A critical flaw allows shared hosting users to execute SQL commands as the database root user, bypassing standard environment isolation and privilege boundaries [12].
- CVE / severity: CVE-2026-58048 / 9.8 (Critical)
- Affected versions: cPanel & WHM (Specific versions not disclosed in sources, implies all unpatched production builds)
- Fixed in: Not disclosed in sources (Referred to as "new critical flaw")
- Action now:
- Monitor database logs for unusual
GRANTorSUPERprivilege executions from unprivileged users. - Apply cPanel security updates immediately via
/scripts/upcpas they become available.
- Monitor database logs for unusual
CyrusOne Data Center Ransomware Attack — The ShinyHunters group claims to have breached CyrusOne, a major infrastructure provider for enterprise and cloud services. Threat actors claim theft of 600GB of SharePoint data and millions of Salesforce records, demanding a $13m ransom [9].
- CVE / severity: no CVE assigned (Ransomware/Data Breach)
- Affected versions: CyrusOne Data Center Infrastructure / Managed Services
- Fixed in: N/A (Incident investigation ongoing)
- Action now:
- Infrastructure teams utilizing CyrusOne should initiate credential rotations for all management consoles.
- Audit SharePoint and Salesforce integrations for unauthorized API access or data exfiltration markers.
🧩 WordPress Core & Theme Vulnerabilities
Avada Theme & Fusion Builder Zero-Click RCE — A complex 6-step chain allows unauthenticated attackers to achieve Remote Code Execution. This affects one of the most widely used premium themes with over 1 million sales [5].
- CVE / severity: CVE-2026-18431 / 9.8 (Critical)
- Affected versions: Avada Theme <= 7.16; Fusion Builder <= 3.16
- Fixed in: Avada 7.16.1 (or latest available) / Fusion Builder 3.16.1
- Action now:
- Update via WordPress Dashboard or manual upload to fixed versions immediately.
- Block suspicious POST requests to
admin-ajax.phpinvolving Fusion Builder components at the WAF level.
WordPress Core XSS-to-Shell — Cloudflare has issued emergency WAF rules to block a new exploit chain that leverages a cross-site scripting vulnerability to achieve full shell access [3].
- CVE / severity: CVE-2026-65640 / 8.8 (High)
- Affected versions: Not disclosed in sources (Affects WordPress Core)
- Fixed in: Not disclosed in sources
- Action now:
- Deploy Cloudflare WAF rules for "XSS2Shell" or equivalent managed rulesets.
- Ensure
DISALLOW_FILE_EDITis set totrueinwp-config.phpto mitigate shell writes.
🔌 Critical Plugin Exploits
WeDevs ERP Unauthenticated Arbitrary File Upload — A critical vulnerability in the ERP suite (100k+ installs) allows attackers to upload PHP files directly to the server, leading to RCE [4], [7].
- CVE / severity: CVE-2026-18080 / 9.8 (Critical)
- Affected versions: ERP: Complete HR, Accounting & CRM <= 1.17.8
- Fixed in: 1.17.9 (or latest available)
- Action now:
wp plugin update erp- Inspect
wp-content/uploads/for unauthorized.phpfiles or obfuscated scripts.
Everest Forms & TranslatePress Account Takeover — Multiple high-traffic plugins are facing critical flaws allowing unauthenticated site takeover. Everest Forms (100k+ sites) is vulnerable to file uploads [2], [6], while TranslatePress allows admin hijacking [1].
- CVE / severity: no CVE assigned (Everest Forms) / no CVE assigned (TranslatePress)
- Affected versions: Everest Forms (versions not disclosed); TranslatePress (versions not disclosed)
- Fixed in: Latest plugin updates available on WordPress.org
- Action now:
- Update all instances of Everest Forms and TranslatePress immediately.
- Audit administrative user lists for new or unrecognized accounts created in the last 48 hours.
On the
road.
Conferences, summits, and WordCamps I’ll be at in the months ahead.
- Aug 16 – 19, 2026
- Sep 28 – 29, 2026
- Domain Days DubaiRescheduled
New dates to be announced.
Oct 15 – 16, 2026 - Nov 11 – 12, 2026
- State of the WordDec 2026
- Mar 15 – 18, 2027
When the servers
go quiet.
A small digital label putting out industrial house, progressive house, and dubstep. A different kind of open protocol.
Twenty years of showing up for the projects, communities, and voices that keep the open web open.
A news portal covering the hosting and domain industry — and a running excuse to keep talking to the people who build it.