Web Hosting News & Industry Updates
Breaking news, M&A deals, pricing moves, security alerts and in-depth analysis for the web hosting industry — 811 articles across 14 categories.
✦ Featured
Industry reports
Most Domains Leaving Hostinger and Namecheap DNS Go to Expiry Pages, Not Rivals
The largest destination for domains leaving Hostinger's and Namecheap's name servers was not a rival but the expiry pages each company uses: about 64% and 70% of the outflow in the period to October 24, by our count. ICANN's rules for expired domains explain how such moves happen.
Who Owns Europe’s Largest Hosting Markets: IONOS Controls the Leader in Germany, Poland and Spain
Industry reports #domains#europe
The four largest Swiss-owned hosts hold 39.8% of .ch domains, while the UK has one British-owned operator among its eight largest. We matched the leading operators in Europe's eight largest domain markets with their owners, and IONOS owns the leader in three of them.
DreamHost Confirms File Manager Breach. FTP/SFTP and Some Webmail Credentials Were Exposed
Security #cybersecurity#dreamhost
A security breach prompted DreamHost's October 23 File Manager shutdown and password resets. An attacker exploited third-party software behind the tool and could access FTP/SFTP credentials of users who signed in, plus some webmail logins. Well under 10% of email and FTP/SFTP accounts were affected.
GoDaddy Q3 2026: Domains Lifted Its Core Segment. The Rest, Including Hosting, Fell $7.4M
Industry reports #airo#domains
GoDaddy's revenue rose 6% to $1.342 billion in Q3 2026. Inside Core, domain revenue rose $40.6 million, while revenue outside domains, where GoDaddy books standalone hosting and security, fell $7.4 million and has declined in every quarter of 2026.
All articles
1–20 of 811
Security
CloudLinux Rolls Out Kernel Fixes for a Local UDP Flaw Used to Crash a Server 12 Times
CloudLinux is rolling out kernel fixes for CVE-2026-98276, a Linux flaw that lets any local user crash a server. An exploit used on November 4 crashed a CloudLinux 8 server 12 times, and in separate tests the company's engineers got root access.
Industry reports
What “Unlimited” Hosting Means at 10 Major Hosts: Storage Caps and Limits Beyond the Plan Page
DreamHost's Unlimited Policy is now "Legacy," and its current plans operate "within finite limits." At 10 hosts, every entry plan has a storage figure, "unlimited" survives mainly on bandwidth, and many of the limits that matter sit in help pages.
Security
CWPdoor Replaces Control Web Panel’s Web Server and Hides Attack Commands From Logs
Attackers are replacing cwpsrv, the web server behind the free hosting panel Control Web Panel, with a backdoored copy. The backdoor stays dormant until it receives a signed request, then runs the attacker's command and keeps that request out of the access logs.
Software reviews
A Vercel for Africa? HOSTAFRICA’s HCode Runs in South Africa
HOSTAFRICA launched HCode on November 5 as its answer to platforms like Vercel, with prices in local currencies across six African countries. The apps run in South Africa. HCode, a rebranded version of the Zanode platform HOSTAFRICA bought in May, starts at R50, or about $3, a month.
Software reviews
Imunify Lets cPanel Customers Set Bot Limits, but They Won’t Work on Nginx or LiteSpeed
Server security vendor Imunify now lets hosting customers set their own bot rules without a support ticket, once their host switches the controls on. A Rate Limiting tab reaches WHM and cPanel, and a WordPress plugin update adds a site-owner allowlist for AI Bot Management.
Partners
Monarx Reviewed 65 Hosts: 10 of 12 Large Hosting Brands Sell Website Security Add-Ons
Monarx's review of 65 hosting providers finds 37 including advanced website protection at no extra cost, 31 selling a separate security product and 18 doing both. Mass-market brands lean toward add-ons, while managed WordPress hosts mostly build protection into the plan.
Pricing updates
Liquid Web Ends Optional Plugin Migration, Moves Customers to Bundle From $350
In May, Liquid Web described its new WordPress plugin plans as "completely optional." From November 16, subscriptions to LearnDash, The Events Calendar and Give move to a four-product package at renewal, with prices starting at $350 a year for one site.
Security
LiteSpeed Patches Critical HTTP/3 Flaw Ahead of November 16 Disclosure
LiteSpeed has patched a critical flaw in LSQUIC, the HTTP/3 library in its server software, and is urging customers to update immediately. It plans to disclose the flaw on November 16. Enterprise 6.3.x servers need 6.3.7 build 8, so the version number alone does not show the fix.
Pricing updates
Wordfence Raises Prices Again. Response Doubles in Two Years
Wordfence will raise the prices of its Premium, Care and Response plans on December 3, the second increase in two years. Response goes to $1,900 a year, double its price until December 2024, and Premium goes to $199. Customers can renew early at current prices until then.
Security
CISA Lists a Fourth WordPress Core Flaw Since July. WordPress Rates This One Low
CISA added CVE-2026-119977 to its Known Exploited Vulnerabilities catalog on November 3, the fourth WordPress core flaw listed since July. It is one of five recent additions in components commonly found on shared hosting servers, by our count.
Industry reports
Most Domains Leaving Hostinger and Namecheap DNS Go to Expiry Pages, Not Rivals
The largest destination for domains leaving Hostinger's and Namecheap's name servers was not a rival but the expiry pages each company uses: about 64% and 70% of the outflow in the period to October 24, by our count. ICANN's rules for expired domains explain how such moves happen.
Security
cPGuard Breach: Updating Removes the Backdoor, Not the Stolen Credentials
On November 2, an attacker used cPGuard's update channel to install a backdoor and collect password hashes on servers where the malicious script ran. OPSSHIELD asks admins to update to 5.88.25 or later and treat servers that installed 5.88.12 to 5.88.19 as potentially compromised.
Industry reports
Who Owns Europe’s Largest Hosting Markets: IONOS Controls the Leader in Germany, Poland and Spain
The four largest Swiss-owned hosts hold 39.8% of .ch domains, while the UK has one British-owned operator among its eight largest. We matched the leading operators in Europe's eight largest domain markets with their owners, and IONOS owns the leader in three of them.
Security
DreamHost Confirms File Manager Breach. FTP/SFTP and Some Webmail Credentials Were Exposed
A security breach prompted DreamHost's October 23 File Manager shutdown and password resets. An attacker exploited third-party software behind the tool and could access FTP/SFTP credentials of users who signed in, plus some webmail logins. Well under 10% of email and FTP/SFTP accounts were affected.
Security
WordPress Update Flaw Draws Tens of Thousands of Attack Attempts. Hosts Can Block It at the Web Server
Wordfence detected probing of the update-window flaw fixed in WordPress 7.1.4 within hours of the October 28 release, with sources polling sites for hours to catch the seconds-long window. A web server rule denying access to wp-content/upgrade/ closes the path for every site on a host.
Industry reports
GoDaddy Q3 2026: Domains Lifted Its Core Segment. The Rest, Including Hosting, Fell $7.4M
GoDaddy's revenue rose 6% to $1.342 billion in Q3 2026. Inside Core, domain revenue rose $40.6 million, while revenue outside domains, where GoDaddy books standalone hosting and security, fell $7.4 million and has declined in every quarter of 2026.
Partners
Atarim V5 turns hosting into a service your customers want to keep
Hosting customers rarely notice reliable infrastructure, but they do notice when their websites stop working. Atarim V5 gives providers a way to offer ongoing AI-powered site care, including updates, monitoring, approvals and reports. The service can be bundled with hosting, sold through WHMCS or offered to small business owners, with white-label and partner billing options.
Industry reports
How Hosting Companies Make Money in 2026: Six Models Compared
Hosting is one industry with six business models. IONOS earns €16.70 a month per customer, GoDaddy values a commerce customer at 83 times a domain-only one, OVHcloud spent about a third of revenue on capex and team.blue has bought about €300 million of revenue since 2020.
Security
Claude Built a Remote Root Exploit for a Linux TCP Bug. Ubuntu Still Has No Fix
CVE-2026-98432, a race in Linux's IPv4 TCP handshake code, can be triggered by an unauthenticated sender. Anthropic describes a root exploit for servers with a multipath TCP listener. As of November 2, Red Hat, Debian and Oracle Linux have fixed kernels, while Ubuntu's fix is pending.
Industry reports
How Hostinger Decides What to Build, Give Away and Drop
Hostinger stopped being just a web hosting company years ago, according to chief product officer Saulius Lazaravičius. On our podcast, he explains how Hostinger decides which products to keep, why its AI agent is mainly free and why 1,000 agent tools can be worse than 50.