Web Hosting News & Industry Updates
Breaking news, M&A deals, pricing moves, security alerts and in-depth analysis for the web hosting industry — 611 articles across 14 categories.
✦ Featured
Security
Januscape and Bad Epoll: Two Linux Flaws That Let One Customer Take Over the Whole Server
Januscape (CVE-2026-53359) lets a guest VM escape to the host and take over co-tenants; Bad Epoll (CVE-2026-46242) lets any unprivileged user reach root with a near-perfect exploit. Both are patched upstream and in AlmaLinux, and for both the only fix is a new kernel and a reboot.
Which Top-Level Domains Are Worth Carrying? The Abuse Data Most Registrars Never Book.
Industry reports #churn#domain
A wide TLD lineup looks like pure margin, but Spamhaus data shows that in extensions like .bond and .lol nearly the whole zone is registered and discarded within months. The reputation, deliverability, and abuse-desk costs are real and unbooked, and ICANN is moving to make them explicit.
GoDaddy Warns It May Exit India Over a Domain-Privacy Ruling
Industry reports #domains#godaddy
A December 2025 Delhi High Court ruling orders registrars to reveal domain owners' details within 72 hours to anyone with a "legitimate interest" and to end default WHOIS privacy. GoDaddy, Namecheap and Hosting Concepts are appealing, and GoDaddy warns it could force registrars to exit India.
Automattic Has Taken Over WebHosting.com. The Plan Is Still a Coming-Soon Page.
M&A #automattic#domains
WebHosting.com, a premium one-word .com long dormant under AT&T, now resolves to an Automattic-branded "coming soon" page, confirming the WordPress parent controls it. There is no announcement, price, or stated plan. The move fits Automattic's broader hosting push, but its plans are unconfirmed.
All articles
1–20 of 611
Security
Januscape and Bad Epoll: Two Linux Flaws That Let One Customer Take Over the Whole Server
Januscape (CVE-2026-53359) lets a guest VM escape to the host and take over co-tenants; Bad Epoll (CVE-2026-46242) lets any unprivileged user reach root with a near-perfect exploit. Both are patched upstream and in AlmaLinux, and for both the only fix is a new kernel and a reboot.
Industry reports
The Free Tier Isn’t Dying Loudly. It’s Being Repriced Quietly. And the Developer Pipeline Goes With It.
Fly.io removed free for new accounts and Netlify doubled credit costs to halve free capacity, while Render, Cloudflare, and a reversing Railway keep free as strategy. The quiet unwinding of developer free tiers decides where the next CTO generation's defaults form.
Security
Three Unauthenticated File Flaws in a Week, and One Root Cause: Validation by Shortcut
Between July 7 and 9, three serious unauthenticated flaws surfaced in file-handling code: an RCE in Blocksy Companion Pro, arbitrary file deletion in Frontend File Manager, and an SSRF in Monsta FTP. Different codebases, one root cause, and a blast radius that lands on the hosting provider.
Software reviews
Extendify Launches Code, a White-Label Vibe-Coding Platform for Hosts
Extendify's new Code platform lets any hosting provider sell prompt-to-app building under its own brand, deployed through WHMCS or API. It answers the customer drift toward vibe-coding tools, and it hands hosts new revenue along with the support and security risks of AI-built software.
Industry reports
Which Top-Level Domains Are Worth Carrying? The Abuse Data Most Registrars Never Book.
A wide TLD lineup looks like pure margin, but Spamhaus data shows that in extensions like .bond and .lol nearly the whole zone is registered and discarded within months. The reputation, deliverability, and abuse-desk costs are real and unbooked, and ICANN is moving to make them explicit.
Industry reports
DigitalOcean Lands Nine-Figure AI Deals as Its Backlog Jumps Tenfold
DigitalOcean, long the cloud for developers, says its preliminary Q2 backlog will top $800 million, up more than tenfold, on multiple nine-figure AI-inference commitments. Revenue growth is re-accelerating to 29 percent, and it now sells itself as an "AI-native cloud" rather than raw GPU rental.
Security
Hostinger Turns On Patchstack npm Scanning for Node.js Apps by Default
Hostinger has built Patchstack's vulnerability intelligence into its Node.js hosting, scanning npm dependencies by default. It targets the unmonitored supply-chain risk of apps shipped fast with AI help, and fits Patchstack's push to embed its security inside large hosts rather than as an upsell.
Industry reports
team.blue Reports the Climate Trade-Off of Consolidation
Europe's hosting groups have consolidated for a decade and now want science-based climate targets to match. But growth by acquisition works against it: each deal adds emissions to the total they have pledged to cut. team.blue's report documents the bind, making it the sector's test case.
Industry reports
GoDaddy Warns It May Exit India Over a Domain-Privacy Ruling
A December 2025 Delhi High Court ruling orders registrars to reveal domain owners' details within 72 hours to anyone with a "legitimate interest" and to end default WHOIS privacy. GoDaddy, Namecheap and Hosting Concepts are appealing, and GoDaddy warns it could force registrars to exit India.
Industry reports
Half a Billion Dollars to Shrink: What Public Filings Say a Hosting Customer Costs in 2026
The FY2025 filings reveal hosting's quiet pivot: marketing spend up, customer counts down, headline metrics retired, ARPU doing the growing. With AI summaries halving search click-through, the volume era of web presence is ending, and the filings say who is adapting how.
Industry reports
One of the Largest Planned Data Centers Died on a Notice Technicality
QTS has withdrawn its final appeal and terminated the Prince William Digital Gateway, a 2,100-acre Northern Virginia campus. Courts voided its rezoning after the county's newspaper notices failed state and local notice rules, ending one of the largest data center projects ever planned.
Security
India’s .bank.in Trust Domain Leaked the Data of the People Who Run It
India's .bank.in namespace was RBI's trust badge against banking phishing. Its registrar, IDRBT, left 33+ unauthenticated APIs exposing bcrypt hashes, emails, phone numbers and device fingerprints of 5,576 domain admins for 13 months. It was fixed in June 2026, with no confirmed exploitation.
Other
UpCloud’s Founder Becomes CEO After a 15-Month Outside Hire
UpCloud has named founder Joel Pihlajamaa as chief executive, ending Arno Schäfer's roughly 15-month tenure and putting the Helsinki cloud provider under founder-led leadership. The company frames it as a natural evolution and a signal that its sovereign, engineering-led strategy stays the course.
M&A
Automattic Has Taken Over WebHosting.com. The Plan Is Still a Coming-Soon Page.
WebHosting.com, a premium one-word .com long dormant under AT&T, now resolves to an Automattic-branded "coming soon" page, confirming the WordPress parent controls it. There is no announcement, price, or stated plan. The move fits Automattic's broader hosting push, but its plans are unconfirmed.
Events
CloudFest Americas Takes Shape: Miami’s Speakers and Themes So Far
CloudFest Americas lands at Miami's Ice Palace Studios on November 11-12, 2026, the Americas edition of Europe's flagship cloud festival. Organizers expect 2,000+ attendees across keynotes, roundtables and a NamesCon co-location, with a five-theme program spanning AI, security and growth.
Industry reports
You Don’t Own Your .io or .ai. You Rent a Country’s Politics.
RFC 1591 says a country-code domain is held in trust, not owned. Build a brand or infrastructure on .io, .ai, or .ly and you rent a foreign government's politics, with a retirement mechanism, seizures, and price ratchets to prove it. The .io Chagos scare was a reprieve, not a resolution.
Other
Meet the New webhosting.today: The Hosting Market Now Has a Scoreboard
The new webhosting.today is live. Market Insights resolves 400M domains and fingerprints 24M hosting IPs monthly, profiling 3,400+ operators across 110+ countries, down to which competitors each host wins and loses domains to. Free to browse; registration opens the full engine.
Industry reports
AI Agents Now Run Hosting Operations, Not Just Content. Pressable’s June Update Is the Tell.
Pressable, an Automattic hosting lab, expanded its MCP integration in June so AI agents can run caching, backups, SSL, WP-CLI and bulk operations across a WordPress portfolio. With Rocket.net shipping a native MCP server too, the hosting control panel is becoming an interface built for agents.
Industry reports
The Hosting Industry Runs on Subscription Billing. Visa Made That More Expensive.
Hosting runs on recurring billing but rarely counts the cost of collecting it. A quarter after Visa's April 2026 VAMP change cut the "excessive disputes" threshold from 220 to 150bps, the exposure is live, and GoDaddy's 10-K spells it out: reserves, higher fees, and settlement losses.
M&A
Google’s TPUs Get a Blackstone-Funded Cloud of Their Own
Google and Blackstone are standing up a separate US company, majority-owned by Blackstone, to build data centers and sell Google's TPU chips as merchant compute beyond Google Cloud. Blackstone is committing $5 billion in equity toward 500 MW by 2027, and late-June hires for a COO and CTO show the venture being built from the ground up at pace.