Jason Nickerson — Hosting Industry InsiderTwo decades
inside the web
as it kept rewriting
itself.
I’m Jason, a hosting industry insider with experience across open-source CMS platforms, control panels, cloud infrastructure, and the events that bring the industry together. Today, I focus on building partnerships, programming industry summits, and documenting what is happening across the hosting ecosystem.
- Nov 3, 2026
Low-Code AI Training Is the New Managed Hosting
Trajectory's $45M raise suggests we are moving past the 'hacker' phase of AI and into the era where the business suite finally takes the wheel.
Read article: Low-Code AI Training Is the New Managed Hosting→ - Nov 2, 2026
OpenAI and the Reality of Shrinking Rounds
When the most talked-about AI company in the world scales back its funding goals, it is a clear signal that the era of the blank check might finally be closing.
Read article: OpenAI and the Reality of Shrinking Rounds→ - Nov 2, 2026
The Domain Tail Wagging the Hosting Dog
GoDaddy's Q3 2026 numbers are out, and the trend is clear: domains are keeping the lights on for the core business while hosting continues to lose its grip.
Read article: The Domain Tail Wagging the Hosting Dog→
The early 2000s were the good years for tinkerers. Open-source CMS platforms were the closest thing we had to a universal starter kit, and PHP-Nuke and osCommerce were how you learned to ship real projects on the open web. I went deep on Joomla for the better part of a decade, contributing code to the project, organizing its community around releases and events, and eventually crossing over into the WordPress orbit that quietly swallowed everything in its path.
From there the story is a tour of the hosting stack: cPanel and the control-panel era that defined shared hosting, the managed cloud wave at Cloudways and DigitalOcean, and the publishing side at webhosting.today. Day to day now I'm at JetBackup, working on backup and disaster recovery and helping hosts protect the infrastructure that keeps everything running. I also program the seasonal industry summits, Atlas Digital Summit and Domain Days Dubai, where the hosting community gathers to set the agenda for what comes next.
The through-line is community, the conferences, the hallway conversations, and the group chats where the industry actually decides what happens next. The technology changes; the people pointing it in the right direction stay the same.
Twenty-something years,
in reverse.
- 2026 – present
FounderAtlas Digital SummitPrivate gatherings for hosting leaders, AI infrastructure innovators, and the builders of the agentic web.
- 2026 – presentFounderConf64
The Conference Operating System for Business Development and Field Marketing Teams.
- 2026 – present
Co-FounderSuperDeployThe advanced migration engine for AI applications. Seamlessly transition your codebase to independent, production-grade infrastructure in minutes.
- 2025 – 2026Director of Business Developmentwebhosting.today
Contract · Business development and partnerships for the hosting publisher.
- 2024 – presentBusiness Development & Partnerships ManagerJetBackup
Backup and disaster recovery for the hosting ecosystem.
- 2023 – present
Chief Marketing Officer, Founding TeamDomain Days DubaiMENA’s domain and digital asset conference.
- 2021 – 2023Senior Manager, WordPress Business Unit → Lead Community Marketing Manager IICloudways / DigitalOcean
Full-time · WordPress community, field marketing, and sales enablement through the acquisition.
- 2019 – 2021Marketing ManagercPanel
Full-time · Event planner and marketing strategist for 500–3,000 attendee events and virtual series.
- 2017 – 2019FounderCMS Summit
The global CMS conference.
- 2007 – 2019CEO | FounderJoomlaxtc.com / Monev Software LLC
Premium Joomla templates and extensions. 101,000+ members.
- 2015 – 2019Board Member, Capital Team ChairJoomla! Project
Leadership, sponsorships, and partnerships for the open-source CMS.
- 2001 – 2005DeveloperPHP-Nuke · osCommerce era
First shipping code in the early open-source web.
Threat Briefing: Brotli-PHP RCE Chain, cPanel Root Escalation & Beget Hosting Attack
⚠️ Infrastructure & Hosting Alerts
cPanel Improper Link Resolution — Remote authenticated users can write arbitrary root-owned files and escalate privileges to root [14].
- CVE / severity: CVE-2026-105476 / Not disclosed in sources
- Affected versions: cPanel & WHM (All versions prior to current security release)
- Fixed in: Consult latest cPanel security tier updates (LTS/Stable/Current)
- Action now: Run
/scripts/upcpimmediately to ensure the latest security binaries are applied; audit for unauthorized symlinks in user directories.
Beget Hosting Infrastructure Attack — One of Russia’s largest hosting providers reported a "massive cyberattack" on its infrastructure starting the night of Nov 2, 2026 [9].
- CVE / severity: No CVE assigned (Infrastructure Incident)
- Affected versions: Beget Shared, VPS, and Dedicated hosting clusters
- Fixed in: Ongoing recovery
- Action now: Beget users should monitor for lateral movement and rotate SSH keys/database credentials if hosted on the impacted infrastructure.
Bulletproof Host Seizure — The FBI has seized the domain of "Virtualine," a known bulletproof hosting provider used by cybercriminals [13].
- Action now: Infrastructure teams should block traffic to/from known Virtualine IP ranges as existing customers may migrate to legitimate providers.
🛡️ Critical Server-Layer Vulnerabilities
Brotli RCE Chained with PHP — A critical Brotli vulnerability (HTTP2Shell) is being chained with two PHP RCE flaws to achieve full server compromise [1, 3].
- CVE / severity: CVE-2026-111497 (Brotli), CVE-2026-109618, CVE-2026-109619 (PHP)
- Affected versions: Brotli versions prior to Oct 21 release; PHP versions impacted by PHP2Shell
- Fixed in: Brotli (Latest stable), PHP (Latest security patches)
- Action now:
- Update system Brotli libraries:
dnf update brotliorapt-get install --only-upgrade libbrotli1 - Recompile/restart Nginx/Apache after library updates to ensure the fixed Brotli version is in use.
- Update system Brotli libraries:
Rejetto HFS Admin Session Forgery — Active scanning observed for a flaw allowing attackers to forge admin cookies and execute code [12].
- CVE / severity: CVE-2026-61500 / Critical
- Affected versions: Rejetto HTTP File Server (HFS) versions prior to Oct 2026 fix
- Fixed in: Consult vendor for latest HFS build
- Action now: Disable HFS instances if not critical; audit administrator accounts for unauthorized session activity.
🧩 WordPress & CMS Security
CryptoPayment Gateway CVSS 10.0 — Massive in-the-wild exploitation attempts targeting a critical flaw in this gateway [7].
- CVE / severity: CVE-2026-81648 / 10.0 (Critical)
- Affected versions: CryptoPayment Gateway for WordPress (Specific versions not disclosed in source)
- Fixed in: Unpatched (Source states "unpatched crypto-payment gateway flaw")
- Action now: Deactivate the plugin immediately until a verified patch is released; monitor logs for unauthorized payment configuration changes.
s2Member Remote Code Execution — RCE via the 'item_name' parameter in the popular membership plugin [6, 8].
- CVE / severity: CVE-2026-86596 / Not disclosed in sources
- Affected versions: s2Member <= 260927
- Fixed in: Not disclosed in sources (Update to latest available version)
- Action now:
wp plugin update s2member. If no update is available, implement a WAF rule blocking suspicious strings in theitem_nameGET/POST parameter.
BuddyPress XProfile Image Deletion — Vulnerability allowing arbitrary file deletion [4].
- CVE / severity: CVE-2026-120518 / Not disclosed in sources
- Affected versions: BuddyPress XProfile Image Field plugin <= 3.1.0
- Fixed in: Not disclosed in sources
- Action now: Deactivate plugin or restrict access to profile image fields to trusted users only.
On the
road.
Conferences, summits, and WordCamps I’ll be at in the months ahead.
- Nov 11 – 12, 2026
- State of the WordDec 2026
- Mar 15 – 18, 2027
When the servers
go quiet.
A small digital label putting out industrial house, progressive house, and dubstep. A different kind of open protocol.
Twenty years of showing up for the projects, communities, and voices that keep the open web open.
A news portal covering the hosting and domain industry — and a running excuse to keep talking to the people who build it.