Web Hosting News & Industry Updates
Breaking news, M&A deals, pricing moves, security alerts and in-depth analysis for the web hosting industry — 709 articles across 14 categories.
✦ Featured
Other
Most of Hostinger’s Hardest Support Cases No Longer Transfer to a Human. The Human Coaches the AI Instead.
Hostinger has merged its support assistant Kodee with its marketing and SEO agents into Hostinger Agent. The bigger change is behind it: on the one conversation in ten the AI cannot settle alone, a specialist advises it instead of taking over, and hard-case resolution rose from 41 to 72 percent.
Automattic’s Board Put Matt Mullenweg on Paid Leave. He Still Leads the WordPress Project.
Other #automattic#matt-mullenweg
Automattic's board has put Matt Mullenweg on paid leave, with chief financial officer Mark Davies as interim chief executive. The change stops at the commercial company: no change has been announced to his leadership of the WordPress project or to his control of WordPress.org.
Non-Developers Are Building Whole Websites With AI. 20i’s Survey Says Only 31.5% Get a Developer’s Review.
Industry reports #20i#ai
A survey of 600 US non-developers who use AI to write code found 16.3 percent building entire websites, 61 percent testing the results themselves and 31.5 percent having a developer review the code. Separate laboratory testing puts the flaw rate near half.
WHMCS Has an Unauthenticated RCE. The Fix Exists Only for 9.0.8 and 8.13.7.
Security #cve#patch
Two WHMCS advisories on September 3: an unauthenticated remote code execution flaw affecting every build since 8.0, and a 2CheckOut gateway flaw exposing client data in versions from 4.5. Both are fixed in 9.0.8 and 8.13.7, and nothing older gets a patch.
All articles
1–20 of 709
Other
Automattic’s Board Put Matt Mullenweg on Paid Leave. He Still Leads the WordPress Project.
Automattic's board has put Matt Mullenweg on paid leave, with chief financial officer Mark Davies as interim chief executive. The change stops at the commercial company: no change has been announced to his leadership of the WordPress project or to his control of WordPress.org.
Security
A cPanel Account With Mail Privileges Could Reach Root. Every Supported Version Was Affected.
cPanel has patched CVE-2026-67401. An authenticated account with mail-related privileges could create files through EmailTrack and reach code execution as root. All supported versions were affected, and the CVE record scores the flaw 9.9 out of 10, critical.
Other
Most of Hostinger’s Hardest Support Cases No Longer Transfer to a Human. The Human Coaches the AI Instead.
Hostinger has merged its support assistant Kodee with its marketing and SEO agents into Hostinger Agent. The bigger change is behind it: on the one conversation in ten the AI cannot settle alone, a specialist advises it instead of taking over, and hard-case resolution rose from 41 to 72 percent.
M&A
What Is Your Hosting Business Worth? The Smallest Deals Are Back at 2.0x.
A hosting owner reading the private-market data finds a ladder from a median of 2.0 times earnings at the bottom to 5.8 at the top. The lower rungs are quoted on the owner's total benefit and the upper ones on EBITDA, and the bottom is exactly where it stood in 2023.
M&A
Team Internet Still Wants Over $160 Million for Its Domains Business. The Timeline It Set in June Has Passed.
Team Internet's sale of its Domains, Identity and Software division is at an advanced stage with multiple parties interested in all or parts of it, the company said on September 7, holding its floor of over $160 million while the outcome it guided for in early Q3 has yet to arrive.
Industry reports
Non-Developers Are Building Whole Websites With AI. 20i’s Survey Says Only 31.5% Get a Developer’s Review.
A survey of 600 US non-developers who use AI to write code found 16.3 percent building entire websites, 61 percent testing the results themselves and 31.5 percent having a developer review the code. Separate laboratory testing puts the flaw rate near half.
Expert's Voice
Is auDA About to Nuke the .com.au Namespace? The $500 Million Red Tape Nightmare
auDA has voted to tie .com.au and .net.au eligibility to an exact match with a company name, ASIC business name or trademark. Domains registered against a product, event or trust structure would no longer qualify, and the cleanup lands on registrars and hosts.
Security
A Magento Zero-Day Is Being Exploited Now. The First Known Victim Was Fully Patched.
Attackers are running code on Magento and Adobe Commerce stores through an unpatched flaw Sansec calls StyleSmuggler. There is no patch and no CVE, the first known victim had a clean patch status, and the backdoor installs in the site user's home directory rather than the web root.
M&A
cyber_Folks Has Over PLN 1 Billion of M&A Capacity. Hosting Is Not the Priority
cyber_Folks puts its capacity for further acquisitions above PLN 1 billion and says the activity will be concentrated in e-commerce. Its hosting arm earns a 51 percent adjusted margin and a quarter of group earnings, while the segment being bought into reported an operating loss.
Security
WHMCS Has an Unauthenticated RCE. The Fix Exists Only for 9.0.8 and 8.13.7.
Two WHMCS advisories on September 3: an unauthenticated remote code execution flaw affecting every build since 8.0, and a 2CheckOut gateway flaw exposing client data in versions from 4.5. Both are fixed in 9.0.8 and 8.13.7, and nothing older gets a patch.
Partners
1,000+ Junk Emails a Day, Brought Under Control by One DNS Change
HeroicGuard filters mail before Google, Microsoft or any other provider receives it. Setup is one MX change, pricing is per domain with unlimited mailboxes, and NameHero's founder tells how it rescued a company address taking a thousand junk messages a day.
Security
Nearly Two-Thirds of All-in-One WP Migration Installs Remain Unpatched Two Weeks Later
Two weeks after the CVE-2026-19949 patch, WordPress.org statistics show 35 percent of installs on the fixed version, leaving about 3.2 million on a vulnerable version. Wordfence has published the chain from trackback to remote code execution, and Patchstack has raised its rating to medium priority.
Industry reports
Parked Domains Distort Hosting Rankings. So Do Corporate Registrars.
National hosting rankings mix five different businesses in one column. By our count, 35 of 115 markets have a domain parking service or a corporate brand-protection registrar among the eight largest names, which leaves fewer domains attributable to hosting providers than the table suggests.
Security
Attacks on the Elementor Pro Flaw Began the Day It Was Disclosed
A critical Elementor Pro flaw was disclosed on August 19 and attacked the same day, with one firewall vendor blocking more than 190,000 attempts. The fix had already shipped, only sites with a published upload form were reachable, and the check for compromise takes one look at a single directory.
Interviews
BalticNOG Interview: The Hosting Industry Is the Missing Voice in the Room
BalticNOG chairman Paulius Judickas talks to webhosting.today about the 220-attendee debut, why building a community across three countries proved harder than filling a room, what the event must never become, and the limited role hosting and data center companies play in it.
Security
A High-Severity Patch for Five Million WordPress Sites Was Labeled as a Text Fix
Two unauthenticated flaws in plugins on millions of WordPress sites were patched the same day, days before the CVE records went public. The changelogs gave no severity signal, and for anyone running a fleet, that gap is the real story.
M&A
DigitalOcean’s Market Cap Is Now Higher Than GoDaddy’s. What Five Public Multiples Say About Hosting Valuations.
GoDaddy is worth less than DigitalOcean on five times the revenue, and OVHcloud's record margin earns the lowest multiple of all. Our arithmetic on five public companies shows what actually moves a hosting valuation, and the logic transfers to private deals.
Security
An Attacker Hijacked Hetzner IP Space and Poisoned a Virtualizor Update
A BGP hijack of Hetzner address space sent Softaculous traffic to an attacker for two nights. A valid Let's Encrypt certificate hid the diversion, update packages were not cryptographically verified, one malicious Virtualizor update got through, and the countermeasure took about 12 hours to arrive.
Other
Proton’s Frankfurt Outage Report: 20 Minutes to Critical, and Hardware Too Scarce to Sacrifice
Proton's outage report is direct about what went wrong: a night-time filter change on both compressors killed the cooling, AI-era density cut the time-to-critical from hours to 20 minutes, and engineers chose to power servers down rather than lose hardware the AI boom has made hard to replace.
Pricing updates
Verisign Lifts .net Wholesale From $10.91 to $12.00, Effective March 1, 2027
A one-line 8-K raises .net wholesale from $10.91 to $12.00 from March 1, 2027, the first increase since February 2024. With 12.5 million registrations renewing at 78.7%, the step is worth up to $13.6 million a year, and resellers have six months to reprice.