Jason Nickerson — Hosting Industry InsiderTwo decades
inside the web
as it kept rewriting
itself.
I’m Jason, a hosting industry insider with experience across open-source CMS platforms, control panels, cloud infrastructure, and the events that bring the industry together. Today, I focus on building partnerships, programming industry summits, and documenting what is happening across the hosting ecosystem.
- Sep 4, 2026
Crusoe, Jane Street, and the $30 Billion Infrastructure Pivot
When data center developers start raising billions on the back of single-contract wins, it's clear the hosting game has shifted from commodity compute to sheer physical scale.
Read article: Crusoe, Jane Street, and the $30 Billion Infrastructure Pivot→ - Sep 4, 2026
The Persistence of the Unpatched Five Million
Over three million WordPress sites remain vulnerable to an SQL injection flaw in a popular migration tool, proving once again that 'set it and forget it' is a dangerous lie.
Read article: The Persistence of the Unpatched Five Million→ - Sep 3, 2026
Palo Alto Networks and the $500M Bet on Boring Automation
Palo Alto Networks has acquired Console for half a billion dollars, signaling a massive shift in how AI-driven IT operations will be handled at the enterprise level.
Read article: Palo Alto Networks and the $500M Bet on Boring Automation→
The early 2000s were the good years for tinkerers. Open-source CMS platforms were the closest thing we had to a universal starter kit, and PHP-Nuke and osCommerce were how you learned to ship real projects on the open web. I went deep on Joomla for the better part of a decade, contributing code to the project, organizing its community around releases and events, and eventually crossing over into the WordPress orbit that quietly swallowed everything in its path.
From there the story is a tour of the hosting stack: cPanel and the control-panel era that defined shared hosting, the managed cloud wave at Cloudways and DigitalOcean, and the publishing side at webhosting.today. Day to day now I'm at JetBackup, working on backup and disaster recovery and helping hosts protect the infrastructure that keeps everything running. I also program the seasonal industry summits, Atlas Digital Summit and Domain Days Dubai, where the hosting community gathers to set the agenda for what comes next.
The through-line is community, the conferences, the hallway conversations, and the group chats where the industry actually decides what happens next. The technology changes; the people pointing it in the right direction stay the same.
Twenty-something years,
in reverse.
- 2026 – present
FounderAtlas Digital SummitPrivate gatherings for hosting leaders, AI infrastructure innovators, and the builders of the agentic web.
- 2026 – presentFounderConf64
The Conference Operating System for Business Development and Field Marketing Teams.
- 2026 – present
Co-FounderSuperDeployThe advanced migration engine for AI applications. Seamlessly transition your codebase to independent, production-grade infrastructure in minutes.
- 2025 – 2026Director of Business Developmentwebhosting.today
Contract · Business development and partnerships for the hosting publisher.
- 2024 – presentBusiness Development & Partnerships ManagerJetBackup
Backup and disaster recovery for the hosting ecosystem.
- 2023 – present
Chief Marketing Officer, Founding TeamDomain Days DubaiMENA’s domain and digital asset conference.
- 2021 – 2023Senior Manager, WordPress Business Unit → Lead Community Marketing Manager IICloudways / DigitalOcean
Full-time · WordPress community, field marketing, and sales enablement through the acquisition.
- 2019 – 2021Marketing ManagercPanel
Full-time · Event planner and marketing strategist for 500–3,000 attendee events and virtual series.
- 2017 – 2019FounderCMS Summit
The global CMS conference.
- 2007 – 2019CEO | FounderJoomlaxtc.com / Monev Software LLC
Premium Joomla templates and extensions. 101,000+ members.
- 2015 – 2019Board Member, Capital Team ChairJoomla! Project
Leadership, sponsorships, and partnerships for the open-source CMS.
- 2001 – 2005DeveloperPHP-Nuke · osCommerce era
First shipping code in the early open-source web.
Threat Briefing: Terraform Registry Hijack, Plex Remote Exploit & All-in-One WP SQLi
Infrastructure & DevOps: Malicious Terraform Modules
Coder Registry Compromise — Attackers breached Coder's Cloudflare infrastructure to redirect registry traffic to malicious servers, delivering backdoored Terraform modules [3]. Infrastructure teams using Coder for automated provisioning face a significant supply chain risk where modules could execute unauthorized code during terraform apply [3].
- CVE / Severity: No CVE assigned / Critical Impact
- Affected versions: Coder Cloudflare-hosted registry infrastructure (impacts users pulling modules via this registry)
- Fixed in: Infrastructure restored by Coder (unauthorized servers removed)
- Action now:
- Inspect
terraform.lock.hclfiles for unexpected provider/module checksums. - Audit recent Terraform executions for unauthorized resource creation or outbound connections.
- Rotate any secrets (cloud provider keys, API tokens) used in Terraform environments during the compromise window.
- Inspect
WordPress / CMS: Active SQLi in Migration Plugin
All-in-One WP Migration SQL Injection — A critical second-order SQL injection vulnerability has been confirmed in the All-in-One WP Migration and Backup plugin, affecting over 3 million sites [4][5]. The flaw allows unauthenticated attackers to achieve Remote Code Execution (RCE) via the migration engine [5].
- CVE / Severity: CVE-2026-19949 / High (CVSS not finalized, but RCE capable)
- Affected versions: All-in-One WP Migration and Backup plugin (specific version range not disclosed in source, but stated as affecting over 3 million active installs) [4].
- Fixed in: Not disclosed in sources; check for latest plugin updates via Dashboard [4].
- Action now:
- Update via CLI:
wp plugin update all-in-one-wp-migrationimmediately. - Check for suspicious
.wpressfiles or unauthorized admin accounts created in the last 48 hours.
- Update via CLI:
Servers & Hosting: Proxy Plug-in Auth Bypass & Plex RCE
Oracle WebLogic Proxy Plug-in Bypass — A critical authentication bypass affects Apache HTTP Servers and iPlanet Web Servers acting as proxies for Oracle WebLogic [14]. This allows attackers to bypass security constraints and access backend resources [14]. Separately, Plex Media Server has issued an urgent patch for multiple vulnerabilities that could lead to server compromise [2].
- CVE / Severity: CVE-2026-21962 (Oracle Proxy Bypass) / High
- Affected versions: Oracle HTTP & WebLogic Proxy Plug-in 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0; Plex Media Server (versions prior to current) [2][14].
- Fixed in: Apply Oracle Critical Patch Update for CVE-2026-21962; Plex Media Server latest stable release [2][14].
- Action now:
- Update Apache/iPlanet proxy modules to the latest patched version provided by Oracle.
- Plex Users: Update media server via the web interface or manual download immediately [2].
Recent Security Roundups & Leaks
- Linux Infrastructure: Recent security advisories have highlighted vulnerabilities in core hosting stack components including BIND, Unbound, Nginx, HAProxy, and Postfix [12].
- Data Breach: Manchester Airports Group suffered a massive leak of 8.8 million records, including PII and contact data, following a ransom refusal [6].
- Credential Market: 153 million driver's license images were discovered on the Nexus cybercrime marketplace, indicating a significant identity theft threat to end-users [8].
On the
road.
Conferences, summits, and WordCamps I’ll be at in the months ahead.
- Aug 16 – 19, 2026
- Sep 28 – 29, 2026
- Domain Days DubaiRescheduled
New dates to be announced.
Oct 15 – 16, 2026 - Nov 11 – 12, 2026
- State of the WordDec 2026
- Mar 15 – 18, 2027
When the servers
go quiet.
A small digital label putting out industrial house, progressive house, and dubstep. A different kind of open protocol.
Twenty years of showing up for the projects, communities, and voices that keep the open web open.
A news portal covering the hosting and domain industry — and a running excuse to keep talking to the people who build it.