Web Hosting News & Industry Updates
Breaking news, M&A deals, pricing moves, security alerts and in-depth analysis for the web hosting industry — 772 articles across 14 categories.
✦ Featured
Other
Mullenweg Retook Automattic in 33 Hours. The Board That Put Him on Leave Is Gone.
Mullenweg's paid leave lasted 33 hours and 20 minutes. He is back as Automattic's chief executive, the directors who voted to sideline him have left, and a new board is in place. Fortune's reconstruction points to divisions over the WP Engine case, but no former director has explained the vote.
Instead of Doubling Its Servers, Hostinger Reworked Its CDN for Every Web Hosting Plan
Other #cdn#hostinger
Rather than double its server count, Hostinger reworked its CDN with ECDSA certificates, kernel TLS and smarter routing, cutting the computing it needs by up to half. The CDN is now included in all web hosting plans, and average response times fell from 965 to 714 milliseconds.
WP Engine v. Automattic: Judge Leans Against Sanctions Over Mullenweg’s Messages
Other #automattic#matt-mullenweg
At the October 7 hearing, Magistrate Judge Ajay Krishnan gave a tentative view against WP Engine's bid to sanction Automattic and Matt Mullenweg over missing messaging-app records. He saw problematic behavior but not "the rest of the story" a spoliation finding needs. A written order is pending.
HostGator Records More Than 51 Million Proactive Security Actions in Brazil Using Monarx Technology
Partners #hostgator#monarx
HostGator and Monarx recorded more than 51 million proactive security actions in Brazil over six months. Gator Protect now covers over 600,000 customers across Latin America, with more than 28 billion files under continuous monitoring.
All articles
1–20 of 772
Other
Mullenweg Retook Automattic in 33 Hours. The Board That Put Him on Leave Is Gone.
Mullenweg's paid leave lasted 33 hours and 20 minutes. He is back as Automattic's chief executive, the directors who voted to sideline him have left, and a new board is in place. Fortune's reconstruction points to divisions over the WP Engine case, but no former director has explained the vote.
Security
Roundcube Fixes 20 Security Flaws, Its Largest Batch Since 1.7.0
Roundcube released 1.6.20 and 1.7.5 on October 19 with 20 security fixes, from IMAP command injection to mail header injection. cPanel and Plesk bundle the 1.6 branch and shipped each of the last four rounds within three to nine days.
Software reviews
Hostinger Takes Google Ads Beyond Website Builder, Into Its Main Dashboard
Hostinger has brought Google Ads into its dashboard. Customers can launch a Performance Max campaign in six steps, with Google-generated ad copy and automatic conversion tracking, and follow leads and cost per lead in the same place. Hostinger charges no extra fee.
Security
Linux Kernel Flaw PwnEscape Lets a Virtual Machine Read Its Host’s Memory. Upstream Fixes Are Out.
PwnEscape, tracked as CVE-2026-99999, can let software inside a virtual machine read memory from the Linux host it runs on. It was demonstrated against Vercel's production sandboxes, and host takeover was shown on the researchers' own machines. Fixed kernels were released on October 15.
Security
nginx Has Disclosed 26 Vulnerabilities in 2026. The Latest Five Are Fixed in 1.30.6 and 1.31.7.
nginx released stable 1.30.6 and mainline 1.31.7 on October 14 with fixes for five vulnerabilities in features from alias and rewrite to HTTP/3 and asynchronous file I/O. The advisories page on nginx.org now lists 26 nginx vulnerabilities from 2026, against two from 2025.
Other
Instead of Doubling Its Servers, Hostinger Reworked Its CDN for Every Web Hosting Plan
Rather than double its server count, Hostinger reworked its CDN with ECDSA certificates, kernel TLS and smarter routing, cutting the computing it needs by up to half. The CDN is now included in all web hosting plans, and average response times fell from 965 to 714 milliseconds.
M&A
Hosting M&A in Q3 2026: The Roll-Ups Kept Buying. Two Big Disposals Ran Past Their Timelines.
The third quarter ended with Sedo and Team Internet's DIS division still unsold, while webgo, Your.Online and Identity Digital kept buying. Gen Digital's reported approach to GoDaddy stayed unconfirmed, and listed hosting shares mostly rose, with DigitalOcean the exception.
Partners
NameHero’s Always-On AI Agent Hosting Comes With Six App Options
NameHero's AI Agent Hosting gives agents and automation tools a server of their own: pick OpenClaw, Hermes Agent, n8n, Claude Code, Open WebUI or Docker at checkout, bring your own model keys and run it around the clock on one flat-priced VPS plan.
M&A
Nextcloud Takes Its First Outside Investor. Armira Growth Joins as a Minority Shareholder.
Nextcloud has taken on Munich-based Armira Growth as a minority shareholder, its first outside investor since its founding in 2016. The founders keep the majority and the AGPL license stays. The company points to lead flow that more than tripled in 2025 and 2026.
Other
WP Engine v. Automattic: Judge Leans Against Sanctions Over Mullenweg’s Messages
At the October 7 hearing, Magistrate Judge Ajay Krishnan gave a tentative view against WP Engine's bid to sanction Automattic and Matt Mullenweg over missing messaging-app records. He saw problematic behavior but not "the rest of the story" a spoliation finding needs. A written order is pending.
Other
ICANN Published 1,615 gTLD Applications. The Hosting Strings Were Taken in 2012, and This Round’s Fight Is Over .agent.
ICANN's 2026 gTLD list is out: 1,615 applications, 891 in contention, 13 bids for .agent and one for .vps. Strings can change until October 21.
Events
Atlas Digital Summit Recap: Bots, Vibe-Coded Apps and AI Visibility
Two days in a Reykjavik theater with hosting, security and cloud leaders: bot traffic, AI-built apps that don't fit the WordPress stack, AI support during incident spikes and how hosting brands get recommended by AI. Plus a to-do list for any hosting company.
Other
InMotion Hosting Seeks a President and COO. Co-Founder Todd Robinson to Become CEO.
InMotion Hosting is recruiting a president and COO to run the company from Q1 2027, as co-founder Todd Robinson prepares to become CEO. The aim is to double the business, and Robinson names missing execution fundamentals and his own stretched time as what holds it back.
Software reviews
GoDaddy Rebuilt Its Domain Appraisal With an LLM. The Cap Rose to $1 Million.
GoDaddy's rebuilt GoValue appraisal adds a large language model and lifts the ceiling from $25,000 to $1 million. It already runs across GoDaddy search, with Afternic, the API, Auctions and bulk valuations moving over by the end of 2026.
Other
The DNS Root Changes Its Key on Sunday. A Resolver That Still Trusts Only the Old One Stops Resolving Everything.
From October 11 the root is signed only by KSK-2024. A validating resolver trusting just the old key fails every lookup within two days. Two dig queries tell.
Industry reports
Automattic Applied for 16 TLDs, Including .matt. Eleven Face Rivals.
ICANN's Reveal Day data shows Automattic applied for 16 new top-level domains, from .wordpress and .woo to .matt. Eleven are wanted by other applicants too, and .human puts Automattic in the same contest as Hostinger and Aruba.
Pricing updates
Plesk, WHMCS and cPanel Cost Up to 20 Percent More in 2027
WHMCS rises 11 to 20 percent and Plesk up to 17.5 percent from January 1, 2027, with Plesk Web Host moving to one price for VPS and dedicated servers. cPanel's four tiers rise 8 to 10 percent and its per-account overage 12 percent, from December 16, 2026.
Security
Vercel Paid $50,000 for a KVM Escape That Has No CVE and No Patch. Every VPS Host Is Waiting for the Write-Up.
Vercel paid $50,000 for a guest-to-host-root KVM escape found in its Firecracker sandbox. No CVE, kernel range or patch is public, and every VPS fleet runs KVM.
Security
Attackers Target Ninja Forms and a WooCommerce Plugin to Hide a WordPress Admin
A single payload delivered through stored XSS in Ninja Forms and WPC Product Bundles rides an administrator's session and can leave four ways back into a WordPress site. Three survive deleting the fake plugin, and one is an admin account the dashboard does not show.
Industry reports
Cloudflare’s BEACON Measures the iPhone Traffic That Google’s CrUX Leaves Out
Cloudflare's BEACON dataset covers every major browser engine, including the iPhone traffic Google's CrUX leaves out, and splits page loads into the stages where time is lost. It strips every domain name, so a host can benchmark against the web but cannot find itself in it.