We pulled real-user Core Web Vitals for two dozen platforms from Google's field data. Closed builders beat premium hosts, sister brands differ by 21 points, HostGator anchors the bottom, and the developer clouds fail on responsiveness. Speed turns out to be a rankable output.
Metabase's cloud service was breached through a zero-day, and the vendor patched every hosted instance before most customers heard. Self-hosted operators had to find out, patch by hand and hunt for evidence. Five customers came forward in four days, and about 2,500 instances remain visible online.
Consolidation is not one strategy. Some groups buy scale and run three brands, others buy presence and run forty-one, and the gap between them is about 150 to 1. Meanwhile six in ten tracked domains still sit outside every group we track.
Cloudflare reached FedRAMP High without a separate gov cloud: one network, U.S.-only processing, 22 agencies on board. One catch: it brands the milestone Class D, a certification FedRAMP's roadmap only pilots next fiscal year. The Pentagon's IL4 is the next target.
Zapscape lets an attacker who controls a guest climb out and seize the Linux host as root. Wherever /dev/kvm is open to ordinary users, a plain shared-hosting box is in range too, because a local user can spin up their own guest. Exploit code is public; patched kernels are rolling out.
Roundcube shipped eleven security fixes across its current and LTS branches, including an IMAP command injection and a conditional code execution flaw. The notes name no CVE identifiers, so version-matching scanners stay quiet, and cPanel has historically taken five to nine days to follow.
Hosting M&A Desk
with Konrad & Łukasz · M&A advisors
Hosting M&A Desk
Sell or acquire a hosting company with expert guidance. We connect sellers with 250+ verified buyers worldwide. Private deals, real valuations, and full support – from strategy to closing.