Jason Nickerson — Hosting Industry InsiderTwo decades
inside the web
as it kept rewriting
itself.
I’m Jason, a hosting industry insider with experience across open-source CMS platforms, control panels, cloud infrastructure, and the events that bring the industry together. Today, I focus on building partnerships, programming industry summits, and documenting what is happening across the hosting ecosystem.
- Nov 13, 2026
The Nvidia Transition: Leadership, Leverage, and the Open Source Question
With Jensen Huang stepping down, the industry is forced to ask if Nvidia's recent embrace of open-weight models was a long-term strategy or just a personality-driven phase.
Read article: The Nvidia Transition: Leadership, Leverage, and the Open Source Question→ - Nov 13, 2026
Finally, a Native Exit Strategy for WordPress
WordPress finally gets serious about data portability with Reprint, a new native tool designed to move entire sites without the usual third-party friction.
Read article: Finally, a Native Exit Strategy for WordPress→ - Nov 12, 2026
Seoul’s Next Export Isn't K-Pop
Nine Korean deep tech startups are eyeing the U.S. market via Disrupt 2027, signaling a shift from domestic stability to global scaling in AI and semiconductors.
Read article: Seoul’s Next Export Isn't K-Pop→
The early 2000s were the good years for tinkerers. Open-source CMS platforms were the closest thing we had to a universal starter kit, and PHP-Nuke and osCommerce were how you learned to ship real projects on the open web. I went deep on Joomla for the better part of a decade, contributing code to the project, organizing its community around releases and events, and eventually crossing over into the WordPress orbit that quietly swallowed everything in its path.
From there the story is a tour of the hosting stack: cPanel and the control-panel era that defined shared hosting, the managed cloud wave at Cloudways and DigitalOcean, and the publishing side at webhosting.today. Day to day now I'm at JetBackup, working on backup and disaster recovery and helping hosts protect the infrastructure that keeps everything running. I also program the seasonal industry summits, Atlas Digital Summit and Domain Days Dubai, where the hosting community gathers to set the agenda for what comes next.
The through-line is community, the conferences, the hallway conversations, and the group chats where the industry actually decides what happens next. The technology changes; the people pointing it in the right direction stay the same.
Twenty-something years,
in reverse.
- 2026 – present
FounderAtlas Digital SummitPrivate gatherings for hosting leaders, AI infrastructure innovators, and the builders of the agentic web.
- 2026 – presentFounderConf64
The Conference Operating System for Business Development and Field Marketing Teams.
- 2026 – present
Co-FounderSuperDeployThe advanced migration engine for AI applications. Seamlessly transition your codebase to independent, production-grade infrastructure in minutes.
- 2025 – 2026Director of Business Developmentwebhosting.today
Contract · Business development and partnerships for the hosting publisher.
- 2024 – presentBusiness Development & Partnerships ManagerJetBackup
Backup and disaster recovery for the hosting ecosystem.
- 2023 – present
Chief Marketing Officer, Founding TeamDomain Days DubaiMENA’s domain and digital asset conference.
- 2021 – 2023Senior Manager, WordPress Business Unit → Lead Community Marketing Manager IICloudways / DigitalOcean
Full-time · WordPress community, field marketing, and sales enablement through the acquisition.
- 2019 – 2021Marketing ManagercPanel
Full-time · Event planner and marketing strategist for 500–3,000 attendee events and virtual series.
- 2017 – 2019FounderCMS Summit
The global CMS conference.
- 2007 – 2019CEO | FounderJoomlaxtc.com / Monev Software LLC
Premium Joomla templates and extensions. 101,000+ members.
- 2015 – 2019Board Member, Capital Team ChairJoomla! Project
Leadership, sponsorships, and partnerships for the open-source CMS.
- 2001 – 2005DeveloperPHP-Nuke · osCommerce era
First shipping code in the early open-source web.
Threat Briefing: Critical Apache mod_http2 RCE, Railway Infrastructure Breach & WP Core
1. INFRASTRUCTURE & SERVERS: Critical Apache HTTP/2 RCE
A critical vulnerability has been identified in the Apache HTTP Server's mod_http2 module, allowing for potential Remote Code Execution (RCE). The flaw was discovered by researchers at Anthropic and Google [5][9][13]. Infrastructure teams using CloudLinux or cPanel/EasyApache 4 must prioritize this update as it targets high-performance web environments [13].
Headline: Critical Apache mod_http2 Remote Code Execution
- CVE / severity: CVE-2026-119618 / Critical
- Affected versions: Apache HTTP Server with
mod_http2enabled (versions not explicitly listed in source; assumed all prior to patch) [5][13]. - Fixed in: Current security releases of Apache;
ea-apache24-mod_http2for CloudLinux/cPanel [13]. - Action now:
- For cPanel/CloudLinux: Run
dnf update ea-apache24-mod_http2followed by/scripts/restartsrv_httpd[13]. - If patching is delayed: Disable the module via
dnf remove ea-apache24-mod_http2orapt-get purge ea-apache24-mod-http2[13].
- For cPanel/CloudLinux: Run
2. CLOUD & DATA CENTER: Railway Infrastructure Breach
Cloud hosting provider Railway has disclosed a significant security incident. Attackers successfully exploited infrastructure-level vulnerabilities to exfiltrate customer authentication secrets [12].
Headline: Railway Cloud Authentication Secret Theft
- CVE / severity: No CVE assigned (Infrastructure exploit) [12].
- Affected versions: All Railway customers using environment variables or authentication tokens stored in the platform [12].
- Fixed in: Infrastructure mitigations applied by Railway [12].
- Action now:
- Rotate all API keys, database credentials, and third-party tokens stored within Railway environment variables immediately [12].
- Review audit logs for unauthorized deployment or resource access [12].
3. WORDPRESS: Core RCE & Plugin Escalations
Following the massive disclosure of 497 vulnerabilities last week, active focus is on CVE-2026-119977, a WordPress Core RCE that allows unauthenticated attackers to execute code [1][2]. Additionally, a critical path traversal in Ninja Forms (CVSS 9.1) and a privilege escalation in CourseCure are being actively monitored [4][8].
Headline: WordPress Core Unauthenticated RCE
- CVE / severity: CVE-2026-119977 / Critical [2].
- Affected versions: WordPress Core (versions not disclosed in sources) [2].
- Fixed in: Latest WordPress Core security release [2].
- Action now: Update WordPress Core immediately via
wp core updateor the administrative dashboard [2].
Headline: CourseCure Privilege Escalation
- CVE / severity: CVE-2026-15309 / High [4].
- Affected versions: CourseCure Courses plugin up to (version not disclosed) [4].
- Fixed in: Latest available version [4].
- Action now: Update the CourseCure plugin to the latest version immediately [4].
Headline: Ninja Forms Path Traversal
- CVE / severity: CVE-2026-126537 / 9.1 (Critical) [8].
- Affected versions:
ninja-forms-uploadsplugin [8]. - Fixed in: Latest version [8].
- Action now: Update
ninja-forms-uploadsto prevent restricted directory access [8].
4. CMS ECOSYSTEM: AcyMailing Multi-Vulnerability Patch
Recent analysis of AcyMailing 11.1.2 confirms fixes for seven security flaws. While some sub-flaws do not affect the WordPress-specific build, several critical data exposure risks remain for users of older versions [7].
Headline: AcyMailing Data Exposure & Authorization Bypass
- CVE / severity: CVE-2026-120466, CVE-2026-118495, CVE-2026-120467, CVE-2026-120470, CVE-2026-120469 [7].
- Affected versions: AcyMailing versions prior to 11.1.2 [7].
- Fixed in: AcyMailing 11.1.2 [7].
- Action now: Update AcyMailing to 11.1.2. Verify that hidden subscriber lists and campaign keys are no longer accessible to unauthorized users [7].
On the
road.
Conferences, summits, and WordCamps I’ll be at in the months ahead.
- State of the WordDec 2026
- Mar 15 – 18, 2027
When the servers
go quiet.
A small digital label putting out industrial house, progressive house, and dubstep. A different kind of open protocol.
Twenty years of showing up for the projects, communities, and voices that keep the open web open.
A news portal covering the hosting and domain industry — and a running excuse to keep talking to the people who build it.