Consolidation is not one strategy. Some groups buy scale and run three brands, others buy presence and run forty-one, and the gap between them is about 150 to 1. Meanwhile six in ten tracked domains still sit outside every group we track.
Cloudflare reached FedRAMP High without a separate gov cloud: one network, U.S.-only processing, 22 agencies on board. One catch: it brands the milestone Class D, a certification FedRAMP's roadmap only pilots next fiscal year. The Pentagon's IL4 is the next target.
Zapscape lets an attacker who controls a guest climb out and seize the Linux host as root. Wherever /dev/kvm is open to ordinary users, a plain shared-hosting box is in range too, because a local user can spin up their own guest. Exploit code is public; patched kernels are rolling out.
Roundcube shipped eleven security fixes across its current and LTS branches, including an IMAP command injection and a conditional code execution flaw. The notes name no CVE identifiers, so version-matching scanners stay quiet, and cPanel has historically taken five to nine days to follow.
Porkbun announced its fourth million domains under management, reached in nine months by the company's own count. The number underneath it matters more: 750,000 customers, up from 450,000 at the last milestone, meaning the registrar is adding people faster than it is adding domains.
WordPress shipped its second security release in three weeks. Around the first one, both ends of the vulnerability lifecycle collapsed: an AI model found the critical chain in 10 hours for about $25, and exploitation began 90 minutes after the patch shipped. Hosting companies own the gap in between.
Hosting M&A Desk
with Konrad & Łukasz · M&A advisors
Hosting M&A Desk
Sell or acquire a hosting company with expert guidance. We connect sellers with 250+ verified buyers worldwide. Private deals, real valuations, and full support – from strategy to closing.