Two decades
inside the web
as it kept rewriting
itself.
I’m Jason, a hosting industry insider with experience across open-source CMS platforms, control panels, cloud infrastructure, and the events that bring the industry together. Today, I focus on building partnerships, programming industry summits, and documenting what is happening across the hosting ecosystem.
- Aug 7, 2026
The $12,500 Table Stakes for the Next Big Thing
TechCrunch Disrupt 2026 is opening up exhibition floor space, but success at these events requires more than just a badge and a branded tablecloth.
Read more→ - Aug 7, 2026
Another Maintenance Window: Keeping the Lights on with WordPress 7.0.3
WordPress 7.0.3 is out with critical security patches, reminding us that the work of securing the web is never truly finished.
Read more→ - Aug 7, 2026
Cheap Bots and Fast Exploits: The New Reality of WordPress Security
When AI can find a critical WordPress vulnerability for the price of a lunch special, the old rules of 'patching eventually' are officially dead.
Read more→
The early 2000s were the good years for tinkerers. Open-source CMS platforms were the closest thing we had to a universal starter kit, and PHP-Nuke and osCommerce were how you learned to ship real projects on the open web. I went deep on Joomla for the better part of a decade, contributing code to the project, organizing its community around releases and events, and eventually crossing over into the WordPress orbit that quietly swallowed everything in its path.
From there the story is a tour of the hosting stack: cPanel and the control-panel era that defined shared hosting, the managed cloud wave at Cloudways and DigitalOcean, and the publishing side at webhosting.today. Day to day now I'm at JetBackup, working on backup and disaster recovery and helping hosts protect the infrastructure that keeps everything running. I also program the seasonal industry summits, Atlas Digital Summit and Domain Days Dubai, where the hosting community gathers to set the agenda for what comes next.
The through-line is community, the conferences, the hallway conversations, and the group chats where the industry actually decides what happens next. The technology changes; the people pointing it in the right direction stay the same.
Twenty-something years,
in reverse.
- 2026 – present
FounderAtlas Digital SummitPrivate gatherings for hosting leaders, AI infrastructure innovators, and the builders of the agentic web.
- 2026 – presentFounderConf64
The Conference Operating System for Business Development and Field Marketing Teams.
- 2026 – present
Co-FounderSuperDeployThe advanced migration engine for AI applications. Seamlessly transition your codebase to independent, production-grade infrastructure in minutes.
- 2025 – 2026Director of Business Developmentwebhosting.today
Contract · Business development and partnerships for the hosting publisher.
- 2024 – presentBusiness Development & Partnerships ManagerJetBackup
Backup and disaster recovery for the hosting ecosystem.
- 2023 – present
Chief Marketing Officer, Founding TeamDomain Days DubaiMENA’s domain and digital asset conference.
- 2021 – 2023Senior Manager, WordPress Business Unit → Lead Community Marketing Manager IICloudways / DigitalOcean
Full-time · WordPress community, field marketing, and sales enablement through the acquisition.
- 2019 – 2021Marketing ManagercPanel
Full-time · Event planner and marketing strategist for 500–3,000 attendee events and virtual series.
- 2017 – 2019FounderCMS Summit
The global CMS conference.
- 2007 – 2019CEO | FounderJoomlaxtc.com / Monev Software LLC
Premium Joomla templates and extensions. 101,000+ members.
- 2015 – 2019Board Member, Capital Team ChairJoomla! Project
Leadership, sponsorships, and partnerships for the open-source CMS.
- 2001 – 2005DeveloperPHP-Nuke · osCommerce era
First shipping code in the early open-source web.
Threat Briefing: WordPress 7.0.3 RCE, ESXi Ransomware, and cPanel Urgent Patches
WordPress Core Security Update
WordPress released version 7.0.3 on August 6, 2026, addressing 12 vulnerabilities. The most critical is a pre-authentication XSS on the login screen that can be weaponized for Remote Code Execution (RCE) [1][3][4].
WordPress Login Screen XSS to RCE — Pre-auth escalation to full site takeover.
- CVE / severity: CVE-2026-64638 | CVSS 8.9 (High/Critical)
- Affected versions: WordPress Core < 7.0.3
- Fixed in: WordPress 7.0.3
- Action now:
- Run
wp core updateimmediately. - Verify automatic updates completed successfully across all managed environments.
- Run
Hosting & Infrastructure Alerts
Active ransomware campaigns and infrastructure-level patches require immediate attention from VPS and dedicated server providers [10][14].
HostDZire ESXi Ransomware Incident — Widespread data loss reported following encryption of hypervisor nodes [10].
- CVE / severity: Not disclosed in sources (exploiting known VMware vulnerabilities)
- Affected versions: VMware ESXi (specific versions not disclosed)
- Fixed in: Consult VMware security advisories for latest ESXi patches
- Action now:
- Patch ESXi hypervisors to the latest build immediately.
- Restrict Management Network access to trusted IPs/VPN only.
- Ensure off-site, immutable backups are current for all VM guests.
Urgent cPanel/WHM Security Patching — New automated update logic deployed to counter emerging threats [12][14].
- CVE / severity: Not disclosed in sources
- Affected versions: cPanel & WHM (all current versions)
- Fixed in: cPanel & WHM v136+
- Action now:
- Run
/usr/local/cpanel/scripts/upcpon VPS/Dedicated servers. - Confirm WHM is configured to apply major security releases within the new 1-hour default window [12].
- Run
Plugin Vulnerabilities & Supply Chain
Multiple high-impact vulnerabilities have been identified in widely used plugins, including PHP Object Injection and RCE [7][8][9].
Export User Data PHP Object Injection — Subscriber-level access leads to object injection [9].
- CVE / severity: CVE-2026-65552 | Critical
- Affected versions: Export User Data <= 2.2.6
- Fixed in: 2.2.7 (or latest available)
- Action now:
wp plugin update export-user-data
Thrive Architect Plugin XSS/RCE — Vulnerability in popular page builder [7].
- CVE / severity: CVE-2026-66694 | Severity not disclosed
- Affected versions: Thrive Architect <= 10.9.3.1
- Fixed in: 10.9.4
- Action now: Update via WordPress dashboard or Thrive Product Manager.
Spider Analyser RCE — Unauthenticated code execution vulnerability [6][8].
- CVE / severity: CVE-2026-66709 (Shop Manager RCE) / CVE-2026-65553
- Affected versions: Spider Analyser (versions not specified in source)
- Fixed in: Not disclosed in sources
- Action now: Deactivate plugin until a patch is confirmed; audit for unauthorized 'Shop Manager' role activity.
On the
road.
Conferences, summits, and WordCamps I’ll be at in the months ahead.
- Aug 16 – 19, 2026
- Sep 28 – 29, 2026
- Domain Days DubaiRescheduled
New dates to be announced.
Oct 15 – 16, 2026 - Nov 11 – 12, 2026
- State of the WordDec 2026
- Mar 15 – 18, 2027
When the servers
go quiet.
A small digital label putting out industrial house, progressive house, and dubstep. A different kind of open protocol.
Twenty years of showing up for the projects, communities, and voices that keep the open web open.
A news portal covering the hosting and domain industry — and a running excuse to keep talking to the people who build it.