Web Hosting News & Industry Updates
Breaking news, M&A deals, pricing moves, security alerts and in-depth analysis for the web hosting industry — 742 articles across 14 categories.
✦ Featured
Other
Automattic Is Not an Owner of the WordPress Marks It Asserted in Court, a Judge Rules
The September 24 order brings back four antitrust claims the same judge had dismissed in an earlier ruling. It also holds that Automattic and Mullenweg are neither owners nor registrants of the WordPress marks, so they cannot assert them in their own right.
Automattic Is Not an Owner of the WordPress Marks It Asserted in Court, a Judge Rules
Other #automattic#web-hosting
The September 24 order brings back four antitrust claims the same judge had dismissed in an earlier ruling. It also holds that Automattic and Mullenweg are neither owners nor registrants of the WordPress marks, so they cannot assert them in their own right.
We Ranked Hosting Two Ways. We Resolved 108 GoDaddy Domains: 96 Point at Amazon.
Industry reports #domains#godaddy
Ranked by domains on their nameservers, GoDaddy leads with 73.1 million. Ranked by hosting attribution it falls to 3.5 million, but that column records whose address space a site is served from. We resolved a sample of GoDaddy's domains: 89% land in blocks registered to Amazon.
IONOS Is Cutting 12% of Its Workforce Five Weeks After Raising Its Revenue Outlook.
Stock reports #ai#cloud
IONOS will reduce headcount from about 3,800 to about 3,350, spending around EUR 35 million once to save up to EUR 30 million a year from 2027. IONOS says the savings will be reinvested, including in AI product development and cloud, and its 2026 adjusted EBITDA forecast is unchanged.
All articles
81–100 of 742
Security
WordPress 7.0.4 Fixes a PNG That Runs Code. The Flaw Was Almost 10 Years Old.
WordPress 7.0.4 closes CVE-2026-65640, present since version 4.7: a file named .png that hides PostScript could reach ImageMagick and Ghostscript and run code on the server. It needs an author account, but XML-RPC skips the upload check, so multi-author and membership sites should update first.
Events
Webhosting Today Experts Join Exclusive Delegate Roster at Domain Summit Europe 2026
Domain Summit Europe 2026 opens August 16 in Kempten, Germany, capping attendance at 60 invited delegates. Three of our experts, Frederick Schiwek, Michiel Grotenhuis and Daniel Stanica, join two days of executive sessions on European hosting and domains, August 17-18.
Industry reports
Google’s Field Data Ranks the Platforms Behind Live Sites by Speed, and the Gap Is More Than Twofold
We pulled real-user Core Web Vitals for two dozen platforms from Google's field data. Closed builders beat premium hosts, sister brands differ by 21 points, HostGator anchors the bottom, and the developer clouds fail on responsiveness. Speed turns out to be a rankable output.
Security
Metabase Cloud Customers Were Patched Before They Knew. Self-Hosted Users Had to Do It Themselves.
Metabase's cloud service was breached through a zero-day, and the vendor patched every hosted instance before most customers heard. Self-hosted operators had to find out, patch by hand and hunt for evidence. Five customers came forward in four days, and about 2,500 instances remain visible online.
M&A
GoDaddy Averages 24 Million Domains Per Brand. team.blue Averages 163,000.
Consolidation is not one strategy. Some groups buy scale and run three brands, others buy presence and run forty-one, and the gap between them is about 150 to 1. Meanwhile six in ten tracked domains still sit outside every group we track.
Security
Cloudflare Reached FedRAMP High Without Building a Separate Government Cloud
Cloudflare reached FedRAMP High without a separate gov cloud: one network, U.S.-only processing, 22 agencies on board. One catch: it brands the milestone Class D, a certification FedRAMP's roadmap only pilots next fiscal year. The Pentagon's IL4 is the next target.
Security
Zapscape Breaks the Linux KVM Boundary. A Server Without a Single VM Can Still Be in Range.
Zapscape lets an attacker who controls a guest climb out and seize the Linux host as root. Wherever /dev/kvm is open to ordinary users, a plain shared-hosting box is in range too, because a local user can spin up their own guest. Exploit code is public; patched kernels are rolling out.
Security
Roundcube Shipped Eleven Security Fixes Without a Single CVE Number
Roundcube shipped eleven security fixes across its current and LTS branches, including an IMAP command injection and a conditional code execution flaw. The notes name no CVE identifiers, so version-matching scanners stay quiet, and cPanel has historically taken five to nine days to follow.
Industry reports
Porkbun Passed 4 Million Domains. The More Interesting Number Is 750,000.
Porkbun announced its fourth million domains under management, reached in nine months by the company's own count. The number underneath it matters more: 750,000 customers, up from 450,000 at the last milestone, meaning the registrar is adding people faster than it is adding domains.
Security
An AI Model Found the WordPress Flaw in Ten Hours for $25. Attackers Weaponized the Patch in Ninety Minutes.
WordPress shipped its second security release in three weeks. Around the first one, both ends of the vulnerability lifecycle collapsed: an AI model found the critical chain in 10 hours for about $25, and exploitation began 90 minutes after the patch shipped. Hosting companies own the gap in between.
Interviews
10,000 Sites Flagged in Weeks: Patchstack and Hostinger on npm Scanning by Default
A month after Hostinger enabled Patchstack's npm scanning by default, the first numbers are in: vulnerable dependencies on more than 10,000 sites. In a dual Q&A, both companies talk auto-fixes, the limits of scanning, and whether hosts will patch dependencies for everyone.
Industry reports
Running a Domain Costs About a Dollar a Year. Here Is What Eight Registries Charge for It.
We compiled the published accounts of eight domain registries. Three independent data points put the cost of operating a domain-year at about a dollar; wholesale prices run from €1 for .de to $11 for .org after its first increase since 2016. Governance, not technology, sets the price.
Industry reports
Hosting’s Next Six Months Are Already Scheduled: Five Dates to Prepare For
September 11 puts vendor silence on a 24-hour clock. Autumn opens the licensing season under a new ownership alignment. Q3 closes the Sedo window. November 1 raises .com to $10.97. January 12 kills egress fees. What prepared operators do before each date.
Software reviews
Blesta 6.0: A Rebuilt Admin, an AI Ticket Autopilot and Native MRR Analytics
Blesta calls 6.0 the biggest release in its history: the Paradigm admin rebuild, an AI layer that answers tickets on a confidence threshold you set, MRR and churn computed natively, and cryptographically signed upgrades. Licenses are $17.95 and $20.95 a month
Industry reports
Montenegro Is Taking .me Back: A State Company Will Run the Million-Domain ccTLD
.me earned 114 million euros since 2008 and the state kept about a third. Montenegro has now started building a state company to take over its ccTLD from GoDaddy and Identity Digital, in the name of digital sovereignty and a bigger share of the money.
Interviews
When 64GB of RAM Costs €3,000: The Shortage Behind Hostinger’s Biggest Server Order
Server costs up 5-6x, components up to 8x, lead times at 30 weeks: Hostinger explains its largest hardware order in our Q&A. COO Aivaras Šimkus on €3,000 RAM, scaling from 5 to 7 million customers, and why certainty is now the main advantage.
M&A
Estonia’s Zone Joins Your.Online, a Roll-Up Now More Than 60 Deals Deep
Your.Online has added Estonia's Zone to a portfolio of 35 brands built through more than 60 acquisitions. The pattern in that list matters: the group already owns Gandi, Blacknight, Heart Internet and o2switch, and is now buying the operators each country names first.
Industry reports
A DNS Record Now Flags Domains for Sale. Adoption Is Up to Registrars.
RFC 10023 defines a "_for-sale" DNS record so a domain owner can advertise a name directly, price and contact included. SIDN built it to loosen the secondary market's grip, but it only works if registrars put the button in front of customers.
Security
N-able’s First Patch Left the Door Open, and Attackers Walked Back Through It
A second CVE in N-able N-central exists because the first patch was incomplete, and it is being exploited to take over MSP consoles and reach every machine they manage. The August 2 hotfix closes the way in, but no vendor statement says it removes the attackers' persistence.
Industry reports
$227,000 to Apply for a New Domain Ending: The First ICANN Round Since 2012 Closes August 12
ICANN's first new gTLD window since 2012 closes August 12: $227,000 per application, country names banned outright, cities needing government letters. Bali wants .bali, and ICANN 87 lands on the island in October, where the bid is due to be announced.