Web Hosting News & Industry Updates
Breaking news, M&A deals, pricing moves, security alerts and in-depth analysis for the web hosting industry — 673 articles across 14 categories.
✦ Featured
M&A
GoDaddy Averages 24 Million Domains Per Brand. team.blue Averages 163,000.
Consolidation is not one strategy. Some groups buy scale and run three brands, others buy presence and run forty-one, and the gap between them is about 150 to 1. Meanwhile six in ten tracked domains still sit outside every group we track.
Cloudflare Is in Every Market We Track. It Leads Fewer Than Half of Them.
Industry reports #cloudflare#dns
Our data across 115 countries: Cloudflare appears in every top eight, GoDaddy in 49. But 375 providers appear in total, 284 of them in a single country, and in five markets the national leader leads by under one point.
Google’s Field Data Ranks the Platforms Behind Live Sites by Speed, and the Gap Is More Than Twofold
Industry reports #market-analysis#performance
We pulled real-user Core Web Vitals for two dozen platforms from Google's field data. Closed builders beat premium hosts, sister brands differ by 21 points, HostGator anchors the bottom, and the developer clouds fail on responsiveness. Speed turns out to be a rankable output.
Hosting’s Next Six Months Are Already Scheduled: Five Dates to Prepare For
Industry reports #com#cpanel
September 11 puts vendor silence on a 24-hour clock. Autumn opens the licensing season under a new ownership alignment. Q3 closes the Sedo window. November 1 raises .com to $10.97. January 12 kills egress fees. What prepared operators do before each date.
All articles
1–20 of 673
Security
Forminator’s 9.8 Flaw, and Eleven More Fixes in Nineteen Days
Forminator's file upload flaw scores 9.8 and needs no authentication, but it takes a form with both an upload and a select field, and the default .htaccess meant to stop execution does nothing on NGINX. The changelog records twelve security releases in nineteen days.
Industry reports
Namecheap Wants 40 Top-Level Domains, and 15 Overlap With Rival Portfolios
The second-largest registrar is moving up the chain with 40 top-level domain applications. Fifteen of them overlap with portfolios published by rival applicants, though two of those rivals filed more than three hundred strings each, which is most of the explanation.
Industry reports
Telegram Applies for .gram After a Sanctions Listing Took Down t.me
A single Telegram channel address in a US sanctions filing took the whole of t.me offline for nineteen hours. Telegram's answer is to apply for its own top-level domain, but a registry contract does not move a company out of the jurisdiction that caused the outage.
Industry reports
my.host Expands Into Europe From a Market With No Dominant Provider
The Dutch host has launched an English site and will add European data centers. The Netherlands is the eleventh most fragmented market we track and its leader holds 12.6 percent, so a challenger there has no dominant incumbent to displace.
Events
BalticNOG 2026: What the Baltic Network Operators Meeting in Riga Means for Hosting Providers
BalticNOG moves from Vilnius to Riga for its second edition. On paper it is a network operators meeting. Read the sponsor list and the topics and it is a hosting infrastructure event, from IPv4 leasing to BGP hijacks to peering.
Industry reports
Cloudflare Is in Every Market We Track. It Leads Fewer Than Half of Them.
Our data across 115 countries: Cloudflare appears in every top eight, GoDaddy in 49. But 375 providers appear in total, 284 of them in a single country, and in five markets the national leader leads by under one point.
Industry reports
ICANN Banned the Private Deals That Ended Most 2012 gTLD Contests
More than 1,600 applications arrived before ICANN's window closed, but the bigger change is the rulebook. Private resolution of contention sets is now prohibited, and unlike its 2012 predecessor the Guidebook says nothing about where the auction money goes.
Industry reports
A Chiller Failure in Phoenix Took Down Namecheap, Liquid Web and phoenixNAP.
Storms knocked out the chillers at RadiusDC's Phoenix site on August 13, and at least four providers went offline behind that failure. The operator's only detailed account appeared on a tenant's status page, and no reason-for-outage report has followed.
Security
The Hypervisor Escape Comes to VMware: CVE-2026-47876 May Let a Guest VM Run Code on the ESX Host
CVE-2026-47876, rated 9.3, may let a guest VM with a VMXNET3 adapter escape to the VMware ESX host. Two vCenter flaws rated 9.8 shipped in the same advisory, and one is already being exploited in the wild.
Industry reports
The Field of cPanel Alternatives Keeps Widening. A Brand-New One Comes From Inside cPanel’s Ecosystem.
Since cPanel moved to per-account pricing in 2019 and raised it most years since, the control panel has become a cost decision. Some hosts run their own panel, others license one of a widening set of independents, though the shift is directional rather than a measured stampede.
Industry reports
Web3 Naming Bids for the DNS Root, and ICANN Names Its Price
ICANN's study group concluded that blockchain naming can integrate with the DNS root, but only if the same string stays under the same owner in both systems. Days before the deadline, ENS reorganized into a foundation to pursue .ens as a closed brand domain, with the earliest launch in 2028.
Security
WordPress 7.0.4 Fixes a PNG That Runs Code. The Flaw Was Almost 10 Years Old.
WordPress 7.0.4 closes CVE-2026-65640, present since version 4.7: a file named .png that hides PostScript could reach ImageMagick and Ghostscript and run code on the server. It needs an author account, but XML-RPC skips the upload check, so multi-author and membership sites should update first.
Events
Webhosting Today Experts Join Exclusive Delegate Roster at Domain Summit Europe 2026
Domain Summit Europe 2026 opens August 16 in Kempten, Germany, capping attendance at 60 invited delegates. Three of our experts, Frederick Schiwek, Michiel Grotenhuis and Daniel Stanica, join two days of executive sessions on European hosting and domains, August 17-18.
Industry reports
Google’s Field Data Ranks the Platforms Behind Live Sites by Speed, and the Gap Is More Than Twofold
We pulled real-user Core Web Vitals for two dozen platforms from Google's field data. Closed builders beat premium hosts, sister brands differ by 21 points, HostGator anchors the bottom, and the developer clouds fail on responsiveness. Speed turns out to be a rankable output.
Security
Metabase Cloud Customers Were Patched Before They Knew. Self-Hosted Users Had to Do It Themselves.
Metabase's cloud service was breached through a zero-day, and the vendor patched every hosted instance before most customers heard. Self-hosted operators had to find out, patch by hand and hunt for evidence. Five customers came forward in four days, and about 2,500 instances remain visible online.
M&A
GoDaddy Averages 24 Million Domains Per Brand. team.blue Averages 163,000.
Consolidation is not one strategy. Some groups buy scale and run three brands, others buy presence and run forty-one, and the gap between them is about 150 to 1. Meanwhile six in ten tracked domains still sit outside every group we track.
Security
Cloudflare Reached FedRAMP High Without Building a Separate Government Cloud
Cloudflare reached FedRAMP High without a separate gov cloud: one network, U.S.-only processing, 22 agencies on board. One catch: it brands the milestone Class D, a certification FedRAMP's roadmap only pilots next fiscal year. The Pentagon's IL4 is the next target.
Security
Zapscape Breaks the Linux KVM Boundary. A Server Without a Single VM Can Still Be in Range.
Zapscape lets an attacker who controls a guest climb out and seize the Linux host as root. Wherever /dev/kvm is open to ordinary users, a plain shared-hosting box is in range too, because a local user can spin up their own guest. Exploit code is public; patched kernels are rolling out.
Security
Roundcube Shipped Eleven Security Fixes Without a Single CVE Number
Roundcube shipped eleven security fixes across its current and LTS branches, including an IMAP command injection and a conditional code execution flaw. The notes name no CVE identifiers, so version-matching scanners stay quiet, and cPanel has historically taken five to nine days to follow.
Industry reports
Porkbun Passed 4 Million Domains. The More Interesting Number Is 750,000.
Porkbun announced its fourth million domains under management, reached in nine months by the company's own count. The number underneath it matters more: 750,000 customers, up from 450,000 at the last milestone, meaning the registrar is adding people faster than it is adding domains.