Jason Nickerson — Hosting Industry InsiderTwo decades
inside the web
as it kept rewriting
itself.
I’m Jason, a hosting industry insider with experience across open-source CMS platforms, control panels, cloud infrastructure, and the events that bring the industry together. Today, I focus on building partnerships, programming industry summits, and documenting what is happening across the hosting ecosystem.
- Sep 5, 2026
The Speed of Sound and Capital: XDOF Hits Unicorn Status
XDOF is reportedly hitting a $1.2 billion valuation just three months after exiting stealth, proving that in the robotics data space, the early bird gets the billion-dollar worm.
Read article: The Speed of Sound and Capital: XDOF Hits Unicorn Status→ - Sep 5, 2026
Patch First, Ask Questions Later
WHMCS has dropped a critical unauthenticated RCE fix, and if you are still running older versions, your entire billing stack is sitting in the line of fire.
Read article: Patch First, Ask Questions Later→ - Sep 4, 2026
Crusoe, Jane Street, and the $30 Billion Infrastructure Pivot
When data center developers start raising billions on the back of single-contract wins, it's clear the hosting game has shifted from commodity compute to sheer physical scale.
Read article: Crusoe, Jane Street, and the $30 Billion Infrastructure Pivot→
The early 2000s were the good years for tinkerers. Open-source CMS platforms were the closest thing we had to a universal starter kit, and PHP-Nuke and osCommerce were how you learned to ship real projects on the open web. I went deep on Joomla for the better part of a decade, contributing code to the project, organizing its community around releases and events, and eventually crossing over into the WordPress orbit that quietly swallowed everything in its path.
From there the story is a tour of the hosting stack: cPanel and the control-panel era that defined shared hosting, the managed cloud wave at Cloudways and DigitalOcean, and the publishing side at webhosting.today. Day to day now I'm at JetBackup, working on backup and disaster recovery and helping hosts protect the infrastructure that keeps everything running. I also program the seasonal industry summits, Atlas Digital Summit and Domain Days Dubai, where the hosting community gathers to set the agenda for what comes next.
The through-line is community, the conferences, the hallway conversations, and the group chats where the industry actually decides what happens next. The technology changes; the people pointing it in the right direction stay the same.
Twenty-something years,
in reverse.
- 2026 – present
FounderAtlas Digital SummitPrivate gatherings for hosting leaders, AI infrastructure innovators, and the builders of the agentic web.
- 2026 – presentFounderConf64
The Conference Operating System for Business Development and Field Marketing Teams.
- 2026 – present
Co-FounderSuperDeployThe advanced migration engine for AI applications. Seamlessly transition your codebase to independent, production-grade infrastructure in minutes.
- 2025 – 2026Director of Business Developmentwebhosting.today
Contract · Business development and partnerships for the hosting publisher.
- 2024 – presentBusiness Development & Partnerships ManagerJetBackup
Backup and disaster recovery for the hosting ecosystem.
- 2023 – present
Chief Marketing Officer, Founding TeamDomain Days DubaiMENA’s domain and digital asset conference.
- 2021 – 2023Senior Manager, WordPress Business Unit → Lead Community Marketing Manager IICloudways / DigitalOcean
Full-time · WordPress community, field marketing, and sales enablement through the acquisition.
- 2019 – 2021Marketing ManagercPanel
Full-time · Event planner and marketing strategist for 500–3,000 attendee events and virtual series.
- 2017 – 2019FounderCMS Summit
The global CMS conference.
- 2007 – 2019CEO | FounderJoomlaxtc.com / Monev Software LLC
Premium Joomla templates and extensions. 101,000+ members.
- 2015 – 2019Board Member, Capital Team ChairJoomla! Project
Leadership, sponsorships, and partnerships for the open-source CMS.
- 2001 – 2005DeveloperPHP-Nuke · osCommerce era
First shipping code in the early open-source web.
Threat Briefing: 440k Hits on Elementor/Super Forms & Hummingbird RCE (9.8)
🚨 Active Mass-Exploitation Alert
Threat actors have launched a massive campaign targeting WordPress form builders, with over 440,000 exploitation attempts blocked in the last 24 hours [5]. The attacks leverage unauthenticated file upload flaws to gain RCE on hosting environments [1][5].
Elementor Pro & Super Forms Unauthenticated RCE
- CVE / severity: CVE-2026-32475 (Elementor) / CVE-2026-14894 (Super Forms) | Critical
- Affected versions: Elementor Pro < 4.2.2; Super Forms < 6.3.314
- Fixed in: Elementor Pro 4.2.2; Super Forms 6.3.314
- Action now:
wp plugin update elementor-pro(v4.2.2+)wp plugin update super-forms(v6.3.314+)- Scan for suspicious PHP files in
/wp-content/uploads/directories.
⚡ High-Impact CMS Vulnerabilities
A critical flaw in the Hummingbird speed optimization plugin allows unauthenticated attackers to write malicious PHP code directly to the server via unsanitized cookie data in debug logs [2].
Hummingbird Performance Unauthenticated RCE
- CVE / severity: CVE-2026-83627 | CVSS 9.8 (Critical)
- Affected versions: Hummingbird ≤ 3.21.0
- Fixed in: 3.21.1 (or latest available version; check WPMU DEV dashboard)
- Action now:
- Disable "Page Cache Debugging" immediately if enabled.
- Update Hummingbird to the latest version immediately.
- Audit web-accessible PHP files for code injected via page-cache logging mechanisms.
Frontend Admin Account Takeover
- CVE / severity: CVE-2026-75816 | Critical
- Affected versions: All versions up to 3.21.0 (verify latest)
- Fixed in: Not disclosed in sources [4]
- Action now: Deactivate the plugin until a patch is confirmed by the developer.
🌐 Infrastructure & Network Security
CISA and security vendors have confirmed active exploitation of two zero-days in SonicWall SMA1000 appliances, currently being used as an entry point for ransomware campaigns targeting infrastructure [13].
SonicWall SMA1000 Zero-Day Exploitation
- CVE / severity: CVE-2026-15409 & CVE-2026-15410 | Critical
- Affected versions: SMA1000 series firmware (specific versions not disclosed in snippet)
- Fixed in: Manufacturer-provided emergency patches [13]
- Action now:
- Apply SonicWall firmware updates immediately.
- Enable MFA for all VPN access.
- Review VPN logs for unauthorized access originating from these CVEs [14].
🔧 Plugin Security Patch Updates
- Jetpack: Vulnerable to Authenticated PHP Object Injection in versions 16.1–16.1.2. Action: Update to Jetpack 16.1.3+ [11].
- WP Event Solution: Multiple flaws including Directory Traversal (< 4.1.21) and Broken Access Control (< 4.1.22). Action: Update to v4.1.22 or higher [6][8].
- Kirki Customizer Framework: SQL Injection in versions 6.0.0–6.2.5. Action: Update to version 6.3.0 [10].
- ComboBlocks: Unauthenticated Hook Injection in v2.2.32 to 2.3.1. Action: Update to v2.3.2+ [3].
On the
road.
Conferences, summits, and WordCamps I’ll be at in the months ahead.
- Aug 16 – 19, 2026
- Sep 28 – 29, 2026
- Domain Days DubaiRescheduled
New dates to be announced.
Oct 15 – 16, 2026 - Nov 11 – 12, 2026
- State of the WordDec 2026
- Mar 15 – 18, 2027
When the servers
go quiet.
A small digital label putting out industrial house, progressive house, and dubstep. A different kind of open protocol.
Twenty years of showing up for the projects, communities, and voices that keep the open web open.
A news portal covering the hosting and domain industry — and a running excuse to keep talking to the people who build it.