Web Hosting News & Industry Updates
Breaking news, M&A deals, pricing moves, security alerts and in-depth analysis for the web hosting industry — 742 articles across 14 categories.
✦ Featured
Other
Automattic Is Not an Owner of the WordPress Marks It Asserted in Court, a Judge Rules
The September 24 order brings back four antitrust claims the same judge had dismissed in an earlier ruling. It also holds that Automattic and Mullenweg are neither owners nor registrants of the WordPress marks, so they cannot assert them in their own right.
Automattic Is Not an Owner of the WordPress Marks It Asserted in Court, a Judge Rules
Other #automattic#web-hosting
The September 24 order brings back four antitrust claims the same judge had dismissed in an earlier ruling. It also holds that Automattic and Mullenweg are neither owners nor registrants of the WordPress marks, so they cannot assert them in their own right.
We Ranked Hosting Two Ways. We Resolved 108 GoDaddy Domains: 96 Point at Amazon.
Industry reports #domains#godaddy
Ranked by domains on their nameservers, GoDaddy leads with 73.1 million. Ranked by hosting attribution it falls to 3.5 million, but that column records whose address space a site is served from. We resolved a sample of GoDaddy's domains: 89% land in blocks registered to Amazon.
IONOS Is Cutting 12% of Its Workforce Five Weeks After Raising Its Revenue Outlook.
Stock reports #ai#cloud
IONOS will reduce headcount from about 3,800 to about 3,350, spending around EUR 35 million once to save up to EUR 30 million a year from 2027. IONOS says the savings will be reinvested, including in AI product development and cloud, and its 2026 adjusted EBITDA forecast is unchanged.
All articles
1–20 of 742
Security
The WordPress 7.1.2 Flaw Was Exploited in Hours. Theme and Host Decide the Damage.
Attackers were writing PHP files through pearcmd.php by the evening of the day WordPress 7.1.2 shipped, and whether a site is reachable at all depends on its theme layout and on register_argc_argv, which is on by default under cPanel below PHP 8.5.
Industry reports
team.blue Added 600,000 Customers and Still Rounds to 3.3 Million. The Report Says Nothing About the Ones Who Left.
team.blue's 2025 report shows €866M ARR and 600,000 new customers, yet a total still rounded to 3.3 million, in a foreword by a CEO on his way out.
Software reviews
EmDash 1.0 Is Stable. Its Sandboxed Plugins Cannot Touch the Database, and That Is the Whole Pitch.
EmDash 1.0 is stable: marketplace plugins run in isolated Workers with declared capabilities, authors own their registry entries, hosts need Node or Workers.
Other
Automattic Is Not an Owner of the WordPress Marks It Asserted in Court, a Judge Rules
The September 24 order brings back four antitrust claims the same judge had dismissed in an earlier ruling. It also holds that Automattic and Mullenweg are neither owners nor registrants of the WordPress marks, so they cannot assert them in their own right.
Other
Dasabo Gave Customers Ten Days to Upload an ID. Refusal Means Termination and No Refund.
A VPS provider gave customers ten days to upload an ID and a live photo or lose their services, with no refund under clause 14.1 of its terms. Dasabo puts the demand only on flagged accounts. Customers on two forums and Trustpilot describe it reaching people who had only paid.
Industry reports
DropCatch Added 300 Registrars. It Now Holds 45 Percent of All ICANN Accreditations.
TurnCommerce's DropCatch added 300 registrar accreditations in one batch, its first since 2016. IANA's list shows 1,501 of 3,321 accreditations carrying its name, and 1,552 on its infrastructure, against 519 on Newfold's SnapNames.
M&A
HostPapa Bought Ingram Micro’s CloudBlue. A Year Later the Group Is Called Managed.com.
A new name sits above HostPapa. Managed.com launched on September 17 covering five brands and more than twenty acquisitions since 2013, a year after it arranged a USD 130 million facility led by Bank of Montreal and bought CloudBlue from Ingram Micro.
Software reviews
cPanel AI Is Generally Available. Meridian Is in the License. Nova Runs on Credits Nobody Has Priced.
cPanel declared cPanel AI generally available on September 17. Meridian, the AI Assistant, AI App Hosting and MCP sit inside the ordinary license, while Nova is partner-only and metered in AI credits whose wholesale price neither cPanel nor WebPros has published.
Industry reports
Newfold Names Sachin Puri CEO From October 1. Sharon Rowlands Stays as Executive Chair.
Sachin Puri will become CEO of Newfold Digital on October 1, with Sharon Rowlands moving to executive chair. Puri already leads both Bluehost Group and Network Solutions Group and will take over a company serving around 6 million customers, following a period of infrastructure changes, AI investment and debt restructuring.
M&A
Norton’s Owner Has Approached GoDaddy. The Market Marked the Target Up 8.7 Percent and the Bidder Down 6.1.
Gen Digital, the owner of Norton and Avast, has made a takeover approach to GoDaddy, the Financial Times reported on September 24. Talks are early and terms undisclosed. The target rose 8.7 percent to $13.2 billion and the bidder fell 6.1 percent to $14.7 billion, leaving them close in value.
Industry reports
Brussels Will Grade Data Centres From A to G on Power and Water.
The European Commission adopted a delegated regulation on September 21 that turns the figures data centers of 500 kW and up already report into a public A to G label for power and water use. First labels are due by August 15, 2027, and the average PUE reported so far is a D on that scale.
Security
cPanel Patches a Root Escalation That Starts From an Ordinary Hosting Account
cPanel patched a privilege escalation running from an ordinary hosting account to root, plus a WP Toolkit flaw reaching other accounts' databases. Three builds shipped September 22, no severity score is published, and one researcher is credited on four root-level flaws across cPanel and Plesk.
Industry reports
ICANN Confirms 1,616 gTLD Applications Proceed. Reveal Day Expected by October 14.
ICANN's September 22 count puts the 2026 gTLD round at 1,616 paid applications out of 1,663, smaller than 2012's 1,930. Reveal Day is due by October 14, the schedule promised for mid-September is now promised for the week of September 28, and contention will be settled without private auctions.
Software reviews
Ask nginx Which Config It Is Running. Not Every Build Will Answer.
nginx can now be asked which configuration it is actually running, a question that had no answer before 1.31.5, and a reload now returns an HTTP status code with the logs attached. The Control API came out of the paid NGINX Plus release, and it ships with no authentication of its own.
Other
GitHub, Salesforce and SharePoint Went Down in Four Days. Nobody Attacked Them.
A GitHub cleanup job saturated the database behind every authenticated request. A Salesforce legacy login service stalled during Dreamforce. A Microsoft configuration change blanked SharePoint pages. Three platforms, four days, and trouble that started inside a shared service path.
Security
WordPress 7.1.1 Fixes a Comment-Form XSS. The Payload Passes the Sanitizer.
WordPress 7.1.1 fixes CVE-2026-93485, a stored XSS delivered through the ordinary comment form by an anonymous visitor and missed by wp_kses. Two of the other ten fixes came from Anthropic, and three in ten sites run a version 6 branch reached only by a backport.
Industry reports
Verisign Will Delete 22,000 .name Domains That Are Paid For. Two Registrants Are Fighting It.
Verisign has ICANN's permission to delete every third-level .name domain in existence, the john.smith.name form the registry launched with, along with the email forwarding service that let a registrant receive mail at [email protected].
Security
A Critical libheif Bug Reachable Through WordPress Uploads Still Has No CVE
A researcher uploaded a crafted photo to a clean WordPress site and left a working PHP file on the server. The flaw is in libheif, a system library that arrives with the operating system, and twenty days after the fix shipped it still has no CVE number for patch pipelines to match.
Security
Three LiteSpeed Security Builds in Six Days: Check Which One Your Servers Run
A cPanel advisory of September 14 covers a LiteSpeed Enterprise flaw that lets a hosting account past CageFS to root. LiteSpeed has since shipped 6.3.7 three times in six days, each build with a security change, and a server patched on the day of the advisory is no longer on the latest one.
Industry reports
AWS Cannot Restore Access to Data Kept Only in Bahrain or One UAE Zone
Six months after both regions were damaged, AWS cannot restore access to resources and data hosted exclusively in Bahrain or in one UAE zone. Most customers migrated in time. For the rest, the only copy that counts is the one kept outside the region.