Jason Nickerson — Hosting Industry InsiderTwo decades
inside the web
as it kept rewriting
itself.
I’m Jason, a hosting industry insider with experience across open-source CMS platforms, control panels, cloud infrastructure, and the events that bring the industry together. Today, I focus on building partnerships, programming industry summits, and documenting what is happening across the hosting ecosystem.
- Sep 14, 2026
Chasing the Herd vs. Owning the Pasture
Insight Partners is taking a measured approach to AI investment, proving that diversification still beats betting the farm on a single lab.
Read article: Chasing the Herd vs. Owning the Pasture→ - Sep 13, 2026
When the G-Man is Actually a Botnet
Revolut falls victim to social engineering via spoofed government requests, proving once again that your biggest security hole is usually sitting in a swivel chair.
Read article: When the G-Man is Actually a Botnet→ - Sep 13, 2026
Profit Margins and Pink Slips: The IONOS Efficiency Paradox
IONOS is cutting twelve percent of its staff just weeks after upgrading revenue forecasts, proving once again that in public hosting companies, growth and job security aren't always friends.
Read article: Profit Margins and Pink Slips: The IONOS Efficiency Paradox→
The early 2000s were the good years for tinkerers. Open-source CMS platforms were the closest thing we had to a universal starter kit, and PHP-Nuke and osCommerce were how you learned to ship real projects on the open web. I went deep on Joomla for the better part of a decade, contributing code to the project, organizing its community around releases and events, and eventually crossing over into the WordPress orbit that quietly swallowed everything in its path.
From there the story is a tour of the hosting stack: cPanel and the control-panel era that defined shared hosting, the managed cloud wave at Cloudways and DigitalOcean, and the publishing side at webhosting.today. Day to day now I'm at JetBackup, working on backup and disaster recovery and helping hosts protect the infrastructure that keeps everything running. I also program the seasonal industry summits, Atlas Digital Summit and Domain Days Dubai, where the hosting community gathers to set the agenda for what comes next.
The through-line is community, the conferences, the hallway conversations, and the group chats where the industry actually decides what happens next. The technology changes; the people pointing it in the right direction stay the same.
Twenty-something years,
in reverse.
- 2026 – present
FounderAtlas Digital SummitPrivate gatherings for hosting leaders, AI infrastructure innovators, and the builders of the agentic web.
- 2026 – presentFounderConf64
The Conference Operating System for Business Development and Field Marketing Teams.
- 2026 – present
Co-FounderSuperDeployThe advanced migration engine for AI applications. Seamlessly transition your codebase to independent, production-grade infrastructure in minutes.
- 2025 – 2026Director of Business Developmentwebhosting.today
Contract · Business development and partnerships for the hosting publisher.
- 2024 – presentBusiness Development & Partnerships ManagerJetBackup
Backup and disaster recovery for the hosting ecosystem.
- 2023 – present
Chief Marketing Officer, Founding TeamDomain Days DubaiMENA’s domain and digital asset conference.
- 2021 – 2023Senior Manager, WordPress Business Unit → Lead Community Marketing Manager IICloudways / DigitalOcean
Full-time · WordPress community, field marketing, and sales enablement through the acquisition.
- 2019 – 2021Marketing ManagercPanel
Full-time · Event planner and marketing strategist for 500–3,000 attendee events and virtual series.
- 2017 – 2019FounderCMS Summit
The global CMS conference.
- 2007 – 2019CEO | FounderJoomlaxtc.com / Monev Software LLC
Premium Joomla templates and extensions. 101,000+ members.
- 2015 – 2019Board Member, Capital Team ChairJoomla! Project
Leadership, sponsorships, and partnerships for the open-source CMS.
- 2001 – 2005DeveloperPHP-Nuke · osCommerce era
First shipping code in the early open-source web.
Threat Briefing: WooCommerce & Events Calendar RCE, Linux Repo Attacks & WP Supply Chain
🚨 Active Exploitation & Critical RCE
WooCommerce Wholesale Lead Capture Critical File Upload — Attackers are actively exploiting a flaw that allows unauthenticated users to upload arbitrary files (e.g., PHP shells) to the server, leading to full site takeover [2][4].
- CVE / severity: No CVE assigned / 9.8 (Critical)
- Affected versions: All versions up to and including 2.0.3.1
- Fixed in: Not explicitly disclosed in sources; recommended to disable the plugin until an update is verified.
- Action now: Check
/wp-content/uploads/for unexpected PHP files; implement file execution blocking in these directories via.htaccessor Nginx config.
The Events Calendar Remote Code Execution (RCE) — A critical vulnerability chain allows unauthenticated attackers to execute code remotely via the plugin's handling of specific requests [3].
- CVE / severity: No CVE assigned / Critical
- Affected versions: All versions up to and including 6.17.4
- Fixed in: 6.17.5 (implied update path)
- Action now: Run
wp plugin update the-events-calendarimmediately. Monitor for unusual processes initiated by the web user.
🖥️ Infrastructure & Server Security
Artifactory Self-Hosted Repository Exploit Chain — Threat actors are chaining two vulnerabilities to compromise self-hosted Linux repositories, potentially leading to supply chain poisoning or credential theft [7].
- CVE / severity: CVEs not disclosed in source / High
- Affected versions: Self-hosted Artifactory instances (version range not disclosed)
- Fixed in: Check vendor advisories for Wiz Research reported patches.
- Action now: Audit access logs for self-hosted repos; ensure repository managers are not exposed directly to the public internet without a VPN/WAF.
cPanel/WHM Security Hardening & Auth Changes — Recent updates have disabled HTTP Basic authentication by default for the cPanel interface to mitigate credential sniffing and brute force [11].
- Affected versions: cPanel & WHM versions prior to 138.0.1
- Fixed in: 138.0.1
- Action now: Upgrade via
/scripts/upcp. If using legacy scripts that rely on Basic Auth, transition to API tokens immediately. Verifyskiphttpauth=1incpanel.configto enforce the new security standard.
📦 WordPress Supply Chain & Plugin Risks
New Automated Plugin Security Reviews — WordPress.org has implemented a mandatory automated review system for all plugin updates. This follows a recent incident where a backdoor was intercepted in a plugin release before reaching the distribution server [1].
- Impact: Reduces risk of supply chain attacks; however, 80% of business sites in regions like Singapore remain vulnerable due to unpatched legacy plugins [5].
- Action now: Enable auto-updates for highly-vetted plugins but maintain a staging environment for critical infrastructure to test compatibility.
CryptoPayment Gateway Auth Bypass — A flaw in AJAX handling allows attackers to bypass authorization checks, potentially impacting payment processing [6].
- CVE / severity: CVE-2026-81648 / 7.5 (High)
- Affected versions: 1.2.1 through 1.2.2
- Fixed in: 1.2.3 (or latest available version)
- Action now:
wp plugin update cryptopayment-gateway-for-woocommerce. Review recent transaction logs for anomalies.
On the
road.
Conferences, summits, and WordCamps I’ll be at in the months ahead.
- Aug 16 – 19, 2026
- Sep 28 – 29, 2026
- Domain Days DubaiRescheduled
New dates to be announced.
Oct 15 – 16, 2026 - Nov 11 – 12, 2026
- State of the WordDec 2026
- Mar 15 – 18, 2027
When the servers
go quiet.
A small digital label putting out industrial house, progressive house, and dubstep. A different kind of open protocol.
Twenty years of showing up for the projects, communities, and voices that keep the open web open.
A news portal covering the hosting and domain industry — and a running excuse to keep talking to the people who build it.