Jason Nickerson — Hosting Industry InsiderTwo decades
inside the web
as it kept rewriting
itself.
I’m Jason, a hosting industry insider with experience across open-source CMS platforms, control panels, cloud infrastructure, and the events that bring the industry together. Today, I focus on building partnerships, programming industry summits, and documenting what is happening across the hosting ecosystem.
- Oct 12, 2026
Ambient AI and the End of the Selective Memory
A $26M seed round for Ambi suggests we are ready to trade our privacy for a searchable database of every conversation we have ever had.
Read article: Ambient AI and the End of the Selective Memory→ - Oct 12, 2026
Passing the Baton in Virginia Beach
InMotion Hosting is looking for new leadership as Todd Robinson moves to the CEO role, signaling a major structural shift for one of the industry's largest independent players.
Read article: Passing the Baton in Virginia Beach→ - Oct 11, 2026
Cloudflare Buys Deno: Betting on the Standard, Not the Workaround
Cloudflare's acquisition of Deno signals a move away from proprietary friction and toward a more standardized, developer-friendly edge computing model.
Read article: Cloudflare Buys Deno: Betting on the Standard, Not the Workaround→
The early 2000s were the good years for tinkerers. Open-source CMS platforms were the closest thing we had to a universal starter kit, and PHP-Nuke and osCommerce were how you learned to ship real projects on the open web. I went deep on Joomla for the better part of a decade, contributing code to the project, organizing its community around releases and events, and eventually crossing over into the WordPress orbit that quietly swallowed everything in its path.
From there the story is a tour of the hosting stack: cPanel and the control-panel era that defined shared hosting, the managed cloud wave at Cloudways and DigitalOcean, and the publishing side at webhosting.today. Day to day now I'm at JetBackup, working on backup and disaster recovery and helping hosts protect the infrastructure that keeps everything running. I also program the seasonal industry summits, Atlas Digital Summit and Domain Days Dubai, where the hosting community gathers to set the agenda for what comes next.
The through-line is community, the conferences, the hallway conversations, and the group chats where the industry actually decides what happens next. The technology changes; the people pointing it in the right direction stay the same.
Twenty-something years,
in reverse.
- 2026 – present
FounderAtlas Digital SummitPrivate gatherings for hosting leaders, AI infrastructure innovators, and the builders of the agentic web.
- 2026 – presentFounderConf64
The Conference Operating System for Business Development and Field Marketing Teams.
- 2026 – present
Co-FounderSuperDeployThe advanced migration engine for AI applications. Seamlessly transition your codebase to independent, production-grade infrastructure in minutes.
- 2025 – 2026Director of Business Developmentwebhosting.today
Contract · Business development and partnerships for the hosting publisher.
- 2024 – presentBusiness Development & Partnerships ManagerJetBackup
Backup and disaster recovery for the hosting ecosystem.
- 2023 – present
Chief Marketing Officer, Founding TeamDomain Days DubaiMENA’s domain and digital asset conference.
- 2021 – 2023Senior Manager, WordPress Business Unit → Lead Community Marketing Manager IICloudways / DigitalOcean
Full-time · WordPress community, field marketing, and sales enablement through the acquisition.
- 2019 – 2021Marketing ManagercPanel
Full-time · Event planner and marketing strategist for 500–3,000 attendee events and virtual series.
- 2017 – 2019FounderCMS Summit
The global CMS conference.
- 2007 – 2019CEO | FounderJoomlaxtc.com / Monev Software LLC
Premium Joomla templates and extensions. 101,000+ members.
- 2015 – 2019Board Member, Capital Team ChairJoomla! Project
Leadership, sponsorships, and partnerships for the open-source CMS.
- 2001 – 2005DeveloperPHP-Nuke · osCommerce era
First shipping code in the early open-source web.
Threat Briefing: WordPress REST API SQLi, LFI in GeoDirectory & Post-Patch Cleanup Ops
🚨 Active Exploitation & Post-Incident Guidance
WordPress Core CVE-2026-87902 Post-Exploitation Alert — Attackers are leveraging persistence mechanisms established prior to the 7.1.2 patch. Simply updating the core does not remove web shells or malicious admin accounts created during the exploit window [1].
- CVE / Severity: CVE-2026-87902 / 9.8 (Critical)
- Affected versions: WordPress Core < 7.1.2
- Fixed in: 7.1.2
- Action now:
- Conduct a full audit of
wp-content/uploadsfor unauthorized PHP files. - Review all users with
administratorroles created in the last 72 hours. - Verify integrity of
index.phpandwp-settings.phpfor appended malicious code.
- Conduct a full audit of
🛠️ Server & Infrastructure Threats
WordPress REST API Batch Endpoint SQLi — A critical SQL injection vulnerability in the /wp-json/batch/v1 endpoint is being targeted by automated tools (WP2Shell). This allows unauthenticated attackers to exfiltrate database contents, including hashed credentials and configuration data [7].
- CVE / Severity: CVE-2026-60137 and CVE-2026-63030 / 9.8 (Critical)
- Affected versions: WordPress Core 6.5 through 7.1.1
- Fixed in: 7.1.2
- Action now:
- Update to 7.1.2 immediately (
wp core update). - If unable to update, use WAF rules to block POST requests to
*/wp-json/batch/v1.
- Update to 7.1.2 immediately (
Ransomware Group 'N0n' Infrastructure Targeting — A new ransomware strain, N0n, is actively targeting US-based infrastructure companies, using leaked credentials to gain initial access [12].
- CVE / Severity: No CVE assigned (Credential Access/Ransomware)
- Affected versions: General Linux/Windows Server infrastructure
- Fixed in: N/A
- Action now:
- Enforce MFA on all SSH and RDP entry points.
- Rotate passwords for all service accounts with infrastructure-wide privileges.
🔌 WordPress Plugin Vulnerabilities
GeoDirectory Local File Inclusion (LFI) — A flaw in the GeoDirectory plugin allows unauthenticated users to include local PHP files, potentially leading to Remote Code Execution (RCE) depending on the server environment [14].
- CVE / Severity: Not disclosed in sources / High
- Affected versions: GeoDirectory (versions not specified in source)
- Fixed in: Check for latest plugin updates via Dashboard.
- Action now:
wp plugin update geodirectory- Restrict file system permissions to prevent the webserver from reading sensitive system files like
/etc/passwd.
Free Gifts for WooCommerce Stored XSS — Unauthenticated users can inject malicious scripts into the store front-end, potentially stealing customer session cookies [2].
- CVE / Severity: CVE-2026-57396 / 7.2 (High)
- Affected versions: Free Gifts for WooCommerce <= 13.1.0
- Fixed in: 13.1.1
- Action now:
- Update plugin to version 13.1.1 immediately.
Insurify Unauthorized AJAX Deletion — A lack of nonce and authorization checks allows unauthenticated users to trigger AJAX actions to delete site content [3].
- CVE / Severity: CVE-2026-86717 / 6.5 (Medium)
- Affected versions: Insurify <= 1.0
- Fixed in: Not disclosed in sources.
- Action now:
- Deactivate the plugin until a patch is verified or implement a WAF rule to block
wp-admin/admin-ajax.php?action=insurify_delete_*.
- Deactivate the plugin until a patch is verified or implement a WAF rule to block
On the
road.
Conferences, summits, and WordCamps I’ll be at in the months ahead.
- Domain Days DubaiRescheduled
New dates to be announced.
Oct 15 – 16, 2026 - Nov 11 – 12, 2026
- State of the WordDec 2026
- Mar 15 – 18, 2027
When the servers
go quiet.
A small digital label putting out industrial house, progressive house, and dubstep. A different kind of open protocol.
Twenty years of showing up for the projects, communities, and voices that keep the open web open.
A news portal covering the hosting and domain industry — and a running excuse to keep talking to the people who build it.