Two decades
inside the web
as it kept rewriting
itself.
I’m Jason, a hosting industry insider with experience across open-source CMS platforms, control panels, cloud infrastructure, and the events that bring the industry together. Today, I focus on building partnerships, programming industry summits, and documenting what is happening across the hosting ecosystem.
- Aug 10, 2026
OpenAI Swallows NextSlide: Death to the Bullet Point
OpenAI's latest acquisition of NextSlide signals a shift from chat boxes to dynamic visual storytelling, making traditional slide decks look like fossils.
Read more→ - Aug 10, 2026
Silent Fixes and the CVE Ghost Town
Roundcube just dropped eleven security patches without a single CVE identifier, leaving hosting providers to play a dangerous game of catch-up.
Read more→ - Aug 10, 2026
DNA Storage in 2026: Did “DNA RAM” Live Up to the Hype?
In 2023, DNA RAM looked ready to transform cloud storage. Three years later, we examine what came true, what did not, and how DNA archives are moving toward commercialization.
Read more→
The early 2000s were the good years for tinkerers. Open-source CMS platforms were the closest thing we had to a universal starter kit, and PHP-Nuke and osCommerce were how you learned to ship real projects on the open web. I went deep on Joomla for the better part of a decade, contributing code to the project, organizing its community around releases and events, and eventually crossing over into the WordPress orbit that quietly swallowed everything in its path.
From there the story is a tour of the hosting stack: cPanel and the control-panel era that defined shared hosting, the managed cloud wave at Cloudways and DigitalOcean, and the publishing side at webhosting.today. Day to day now I'm at JetBackup, working on backup and disaster recovery and helping hosts protect the infrastructure that keeps everything running. I also program the seasonal industry summits, Atlas Digital Summit and Domain Days Dubai, where the hosting community gathers to set the agenda for what comes next.
The through-line is community, the conferences, the hallway conversations, and the group chats where the industry actually decides what happens next. The technology changes; the people pointing it in the right direction stay the same.
Twenty-something years,
in reverse.
- 2026 – present
FounderAtlas Digital SummitPrivate gatherings for hosting leaders, AI infrastructure innovators, and the builders of the agentic web.
- 2026 – presentFounderConf64
The Conference Operating System for Business Development and Field Marketing Teams.
- 2026 – present
Co-FounderSuperDeployThe advanced migration engine for AI applications. Seamlessly transition your codebase to independent, production-grade infrastructure in minutes.
- 2025 – 2026Director of Business Developmentwebhosting.today
Contract · Business development and partnerships for the hosting publisher.
- 2024 – presentBusiness Development & Partnerships ManagerJetBackup
Backup and disaster recovery for the hosting ecosystem.
- 2023 – present
Chief Marketing Officer, Founding TeamDomain Days DubaiMENA’s domain and digital asset conference.
- 2021 – 2023Senior Manager, WordPress Business Unit → Lead Community Marketing Manager IICloudways / DigitalOcean
Full-time · WordPress community, field marketing, and sales enablement through the acquisition.
- 2019 – 2021Marketing ManagercPanel
Full-time · Event planner and marketing strategist for 500–3,000 attendee events and virtual series.
- 2017 – 2019FounderCMS Summit
The global CMS conference.
- 2007 – 2019CEO | FounderJoomlaxtc.com / Monev Software LLC
Premium Joomla templates and extensions. 101,000+ members.
- 2015 – 2019Board Member, Capital Team ChairJoomla! Project
Leadership, sponsorships, and partnerships for the open-source CMS.
- 2001 – 2005DeveloperPHP-Nuke · osCommerce era
First shipping code in the early open-source web.
Threat Briefing: Roundcube IMAP Injection, CheckView API Bypass, & Neo4j Auth Bypass
1. INFRASTRUCTURE & HOSTING LAYER
Roundcube Webmail Multiple Security Fixes — Crucial updates for mail server environments fixing 11 vulnerabilities, including IMAP command injection, though no CVEs were assigned [11].
- CVE / severity: No CVE assigned / High
- Affected versions: Roundcube 1.7.x < 1.7.3, 1.6.x < 1.6.18
- Fixed in: 1.7.3 and 1.6.18
- Action now: Update Roundcube via package manager or direct download immediately to mitigate IMAP injection risks.
Neo4j GraphQL Authentication Bypass — Unauthenticated clients can forge JWT claims to read sensitive subscription data in containerized or cloud database environments [6].
- CVE / severity: CVE-2026-5423 / 8.8 (High)
- Affected versions: Neo4j GraphQL Library < 6.1.0
- Fixed in: 6.1.0
- Action now: Update
@neo4j/graphqlto 6.1.0 vianpm updateoryarn upgrade.
cPanel & WHM Critical Updates — CISA and regional security alerts highlight ongoing critical vulnerabilities affecting cPanel & WHM services [10, 12].
- CVE / severity: Not disclosed in sources
- Affected versions: Multiple versions of cPanel & WHM
- Fixed in: Current stable/release tiers
- Action now: Run
/scripts/upcpto ensure the latest security patches are applied to hosting control panels.
2. WORDPRESS & CMS VULNERABILITIES
CheckView REST API Authentication Bypass — A critical flaw allowing unauthenticated attackers to create administrator accounts via a REST API bypass [14].
- CVE / severity: CVE-2026-18786 / 9.8 (Critical)
- Affected versions: CheckView plugin < 2.3.2
- Fixed in: 2.3.2
- Action now:
wp plugin update checkview; audit WordPress users for unauthorized administrator accounts.
Askeet Plugin SQL Injection — Multiple AJAX actions permit unauthenticated SQL injection via the 'sql_query' parameter [2].
- CVE / severity: Not disclosed in sources / 9.8 (Critical)
- Affected versions: Askeet plugin (all versions prior to current)
- Fixed in: Not disclosed in sources; check for developer updates
- Action now: Deactivate and remove the Askeet plugin until a patch is verified; monitor database logs for suspicious queries.
Ajax Search Lite & WP Umbrella Vulnerabilities — Critical XSS and CSRF risks disclosed in high-install plugins [1, 13].
- CVE / severity: CVE-2026-28139 (Ajax Search Lite); CVE-2026-28340 (WP Umbrella / CSRF)
- Affected versions: Ajax Search Lite (through current version); WP Umbrella 2.24.2–2.26.2
- Fixed in: Check for 2026-08-11 updates in the WordPress repository
- Action now: Update plugins via
wp plugin update --all. For WP Umbrella, ensure version exceeds 2.26.2.
3. ACTIVE THREATS & INCIDENTS
Silk Typhoon Backdoor Campaign — Declassified reports confirm the discovery of 88,000 compromised servers globally utilizing persistent backdoors for long-term Chinese state-sponsored espionage [9].
- Impact: Persistent server-level persistence affecting infrastructure across multiple continents.
- Action now: Perform deep-system integrity checks for unauthorized cron jobs, binary modifications, and SSH keys. Deploy EDR tools to detect non-standard outbound traffic.
Aesto Health / AWS Compromise — A data security incident affecting Amazon Web Service (AWS) infrastructure used for health data processing [7].
- Action now: Infrastructure teams using third-party health APIs should audit IAM roles and rotation schedules for AWS access keys.
On the
road.
Conferences, summits, and WordCamps I’ll be at in the months ahead.
- Aug 16 – 19, 2026
- Sep 28 – 29, 2026
- Domain Days DubaiRescheduled
New dates to be announced.
Oct 15 – 16, 2026 - Nov 11 – 12, 2026
- State of the WordDec 2026
- Mar 15 – 18, 2027
When the servers
go quiet.
A small digital label putting out industrial house, progressive house, and dubstep. A different kind of open protocol.
Twenty years of showing up for the projects, communities, and voices that keep the open web open.
A news portal covering the hosting and domain industry — and a running excuse to keep talking to the people who build it.