News

HostPapa acquired Hostwinds on April 29, adding self-owned data centers in Seattle and Amsterdam and a developer and reseller customer base to its portfolio, twelve days after acquiring Tailor Made Servers in Dallas.

cPanel disclosed a critical authentication bypass on April 28 affecting nearly all versions of cPanel and WHM, with active exploits confirmed in the wild before the patch was released, forcing hosting.com, Namecheap, KnownHost, HostPapa, and InMotion Hosting to take cPanel access offline globally.

South African ISP Axxess acquired Absolute Hosting as part of a deliberate 2026 strategy to grow hosting revenues, with founder Jade Benson remaining managing director and the company continuing to operate independently under its own brand.

Automattic launched Studio Code in public beta, a CLI agent built on Anthropic's Claude Sonnet 4.6 that builds, configures, and publishes WordPress sites from natural language commands, running on top of MCP write capabilities launched in March 2026.

The market for running OpenClaw splits cleanly into providers that have made it accessible and providers that have made it secure, and those are currently different products at different price points.

WordCamp Europe is where WordPress platform decisions get made in public before they reach the market. The 2026 edition runs June 4-6 in Kraków, two weeks after WordPress 7.0 ships. For hosting providers, being in the room matters more this year than most.

GatorClaw runs AI agents on a persistent VPS for SMBs. Bluehost's Sean Dundon answered ten written questions about governance, prompt injection, credential handling, and how the product compares to Hostinger, DigitalOcean, and OneClaw. Two gaps were acknowledged directly.

At Cloud Next '26 in Las Vegas, Google introduced eighth-generation TPUs, a 4x-bandwidth data center network, 10 TB/s storage, and a $750 million partner fund. Production results from Citadel Securities, Deutsche Telekom, and GE Appliances show what the platform delivers at scale. Here is what hosting providers and IT buyers need to know.

DE{CODE} 2026 brings together 7,500+ developers, agencies, and digital leaders on May 6 in two regional broadcasts. For hosting providers, the bot management session with Cloudflare, the ACF machine-readable content update, and the WordPress 7.0 preview are the most operationally relevant sessions. Registration is free and available separately for EMEA and the United States.

Your.Cloud's acquisition of Cloud Geeni is the Dutch MSP consolidator's fourth UK deal, adding an ISO 27001-certified managed service provider with a 16-year proprietary private cloud platform and a customer base spanning legal, manufacturing, and financial services. Cloud Geeni retains its brand, team, and management under Your.Cloud's decentralized model, which has become the group's primary tool for attracting owner-operated MSPs across Europe.

The WordPress 7.0 core team published its revised schedule with the development branch closed to 7.1 commits until 7.0 ships and all backports requiring sign-off from two core committers. For hosting providers, the PHP 7.4 minimum requirement is the immediate action item: any environment still running PHP 7.2 or 7.3 as a default will create friction for customers at upgrade time, and the May window is closing.

Cloudflare is already sending over one billion daily 402 responses to AI crawlers. Its April 2026 GoDaddy partnership gave 20 million hosting customers tools to block or charge bots. Now Cloudflare released a tool that scores sites in the other direction: how well they support AI agents. Scanning 200,000 top domains, only 4% declare AI preferences and fewer than 15 support machine-readable API standards. For hosting providers, the scoring criteria map directly onto platform configuration decisions by customer segment.

The Cloudflare Registrar API formalizes a shift that is already underway: AI agents checking availability, registering names, and configuring DNS without human sign-off. The API uses at-cost pricing, default WHOIS privacy, and account payment credentials. A registrar-as-a-service platform for hosting providers is planned for later in 2026. The governance questions around agent spend control and credential scope are not solved by default.

Ayaz Ahmed Khan of DigitalOcean explains how Cloudways Copilot reduces infrastructure troubleshooting from 30-40 minutes to 5-6 minutes, what the preview period taught the team, and where automated diagnosis still falls short.

The EU awarded EUR 180 million in sovereign cloud contracts to four European provider consortia and introduced the SEAL framework, which for the first time defines cloud sovereignty through measurable levels rather than political principles.

Cloudflare's Agents Week, April 12-17, 2026, produced more than 20 announcements spanning compute, storage, networking, browser, email, voice, and developer tooling. The week followed Anthropic's April 8 managed agent launch and an 11 percent Cloudflare stock decline two days later.

Vercel confirmed unauthorized access to its internal systems on April 19, 2026, while a threat actor claiming affiliation with ShinyHunters posted on BreachForums offering to sell the alleged dataset including GitHub tokens, NPM tokens, API keys, and source code for $2 million.

HostPapa acquired Tailor Made Servers, a Dallas dedicated server provider operating since 2003, adding its customer base to the ColoCrossing brand as part of an acquisition run that has included more than 17 deals since 2020.

The blockchain domain company that hit a $1 billion valuation in 2022 has quietly become a traditional ICANN registrar, and its 10 new shell accreditations are a competitive move in the domain expiry market rather than preparation for the new gTLD round opening April 30. In parallel, Unstoppable Domains is sponsoring more than 19 organizations through the gTLD process, including .agent with Sentient Foundation and .blockchain with Blockchain.com, establishing a role as the bridge between the Web3 domain ecosystem and the traditional DNS system.

Flippa celebrated the six-figure sale of the Essential Plugin portfolio; eight months later the buyer activated a backdoor across 20,000+ WordPress sites using Googlebot cloaking and a C2 routed through an Ethereum smart contract.