Web Hosting News & Industry Updates
Breaking news, M&A deals, pricing moves, security alerts and in-depth analysis for the web hosting industry — 812 articles across 14 categories.
✦ Featured
Software reviews
A Vercel for Africa? HOSTAFRICA’s HCode Runs in South Africa
HOSTAFRICA launched HCode on November 5 as its answer to platforms like Vercel, with prices in local currencies across six African countries. The apps run in South Africa. HCode, a rebranded version of the Zanode platform HOSTAFRICA bought in May, starts at R50, or about $3, a month.
Monarx Reviewed 65 Hosts: 10 of 12 Large Hosting Brands Sell Website Security Add-Ons
Partners #cybersecurity#monarx
Monarx's review of 65 hosting providers finds 37 including advanced website protection at no extra cost, 31 selling a separate security product and 18 doing both. Mass-market brands lean toward add-ons, while managed WordPress hosts mostly build protection into the plan.
Who Owns Europe’s Largest Hosting Markets: IONOS Controls the Leader in Germany, Poland and Spain
Industry reports #domains#europe
The four largest Swiss-owned hosts hold 39.8% of .ch domains, while the UK has one British-owned operator among its eight largest. We matched the leading operators in Europe's eight largest domain markets with their owners, and IONOS owns the leader in three of them.
DreamHost Confirms File Manager Breach. FTP/SFTP and Some Webmail Credentials Were Exposed
Security #cybersecurity#dreamhost
A security breach prompted DreamHost's October 23 File Manager shutdown and password resets. An attacker exploited third-party software behind the tool and could access FTP/SFTP credentials of users who signed in, plus some webmail logins. Well under 10% of email and FTP/SFTP accounts were affected.
All articles
181–200 of 812
Industry reports
Verisign Finally Won .web. Unlike .com, No One Caps Its Price.
On July 22, after a decade of litigation, Verisign won .web. It arrives as the company posts a record .com quarter, and unlike .com, whose price is capped by a US government agreement, .web has no such ceiling. What a freely priced premium domain under the .com monopolist means for the market.
Security
A Malware Campaign Is Using GitHub Actions to Hunt Unpatched cPanel Servers
Three months after cPanel's emergency patch, attackers have turned GitHub Actions into a distributed fleet that scans the internet for servers still exposed to CVE-2026-41940 and harvests their cloud keys, tokens and database logins. How it works, and what to check.
Industry reports
August 2 Is Still Real: What the AI Act’s Big Date Means for Hosting After the Omnibus
The Digital Omnibus moved the AI Act's high-risk obligations to December 2027, and much of the industry heard "delay." But August 2, 2026 still activates Commission fines up to 3% of turnover for GPAI providers and transparency duties for new AI systems. Where hosts sit, step by step.
Industry reports
An AWS Region Has Been Offline for Months, and the Cloud’s Address Is No Longer a Technicality
The war between the US and Iran has kept an entire AWS cloud region offline for months, something ordinary outages never do. Why losing one region can take an unprepared business down, and what real disaster recovery requires.
Expert's Voice
The Hosting Price Squeeze, Part 2: Should You Actually Pass It On?
Part two of the hosting price squeeze series tackles the decision that keeps founders up at night: pass rising costs on, absorb them, or find a middle path. A segment-by-segment guide to raising prices without breaking customer trust.
Industry reports
A Government ID for Every .ru Domain, and a Warning for Every Country Code
From September 1, everyone holding a .ru domain must verify their identity through a Russian government system or lose the name, and foreign owners are the ones most exposed. It is a blunt reminder that a country-code domain carries the politics of the country behind it.
Security
A Once-a-Decade WordPress Core Flaw, and the Gap Between Patched and Safe
A critical flaw in WordPress core, the first of its kind in nearly a decade, triggered a rare forced update to millions of sites. Within 72 hours it was mass exploitation, because forced updates never reach everyone. Why patched and safe are not the same thing.
Security
A 16-Year-Old KVM Escape, and OVHcloud’s Week-Long Patch Across a Million VMs
A 16-year-old flaw in KVM let a customer with admin access escape their virtual server and seize the host on both Intel and AMD. OVHcloud built a fix and rebooted around a million VMs in a week to deploy it, and the campaign shows the quiet choice every host makes between your consent and your safety.
Industry reports
H1 2026: The Six Months That Repriced Hosting
H1 2026 synthesized from forty pieces of verified reporting: renewal spreads past 5x, RAM and storage up 50–300%, domain escalators restarted into record demand, the acquisition funnel measurably broken, $850B of leases off balance sheet, and the machine customer arriving. Growth by invoice.
Security
A Critical Nginx Flaw and Who Is Actually Exposed
F5 patched CVE-2026-42533, a heap-overflow flaw in Nginx rated 9.2 that has sat in the code since 2011. It is unauthenticated and remote, but only triggers under a specific regex-map configuration, so not every server is exposed. With a proof-of-concept exploit due in early August, here is who actually needs to patch.
Security
An Unauthenticated Path to Code Execution in WordPress Core, Already Being Exploited
A flaw in the heart of WordPress lets a complete stranger seize a site without ever logging in, and the attacks began the day it was disclosed. Millions of sites run the vulnerable code, and the only real protection is an update most owners assume already happened.
Industry reports
Cloudways Just Handed AI Agents the Admin Panel, and the Locks Are Racing to Catch Up
Cloudways' MCP server now exposes 244 tools, letting an AI agent run security scans, deployments, and billing on your hosting by chat. It is part of a wave, from DigitalOcean to cPanel, and its role-based scoped tokens stand out in a category where research finds many MCP servers insecure.
Expert's Voice
The Hosting Price Squeeze, Part 1: Why Your Costs Keep Climbing
Almost everything hosts depend on has gone up fast: energy, hardware, consolidation, and above all software licensing, from cPanel's post-2019 climb to Broadcom's VMware reset. Part one of a three-part series on what is really driving hosting costs up.
Software reviews
We Asked Six Hosting AI Assistants to Name a Better Rival. Not One Would.
We tested the public AI assistants of six hosting companies against a demanding WooCommerce buyer. Asked which rival would fit better, with no list to choose from, not one named a competitor, so the real test became how well they deflected. Bluehost's assistant broke, and the most useful answers did not come from the priciest names.
Industry reports
GoDaddy Opens Its Domain API to AI Agents, With Guardrails Built In
GoDaddy's new Developer Platform lets AI agents search, register, and manage domains without a browser. Unlike the first wave's "no human required" pitch, it ties every registration to a recorded consent object and scoped tokens, the domain version of the authorization pattern agentic commerce is converging on.
M&A
Green Olive Tree Acquires ZebraHost for $1.1 Million, Nearly Doubling in Size
Green Olive Tree, a veteran-owned managed host, has acquired ZebraHost LLC for $1.1 million, closing June 22 and nearly doubling its revenue. Struck as ZebraHost's 76-year-old founder retires, it shows the founder-succession M&A quietly consolidating hosting's small end.
Security
Roundcube’s Zero-Click Webmail XSS, and How Fast It Reached cPanel
A zero-click stored XSS in Roundcube webmail, scored CVSS 7.2, lets a crafted plain-text email run script in a victim's session on preview. Roundcube fixed it on July 5, cPanel shipped it in 134.0.45 on July 14, and standalone installs still need patching separately.
Partners
Top 5 Mistakes Hosting Companies Make That Drives Churn and How to Fix Them
Customers rarely churn because they found a better host; they leave because they felt lost, overwhelmed, or misled. Extendify lays out five fixable experience gaps, from confusing plans to invisible security, that decide whether a first-time customer stays or disappears.
Security
A US Sanction, a Montenegrin Domain, and Why Every t.me Link Went Dark
Telegram's t.me domain went offline worldwide, placed on serverHold by the .me registry. The likely trigger is a US OFAC sanction on a cybercrime group whose t.me address was listed, enforced through a Montenegrin ccTLD run by US firms Identity Digital and GoDaddy. One URL, a whole domain down.
M&A
The Balance Sheet Behind Your Renewal Invoice: Who Owns the Hosting Industry, and What It Owes
Your renewal invoice has a balance sheet behind it. We mapped hosting's private-equity owners, their debt, and the 2028 maturity wall against our own Renewal Multiplier Index: the most leveraged operator restructured in December, the tooling layer is reportedly funding sponsor dividends, and the debt-free cohort is quietly taking the customers.
Reach hosting professionals
Sponsor webhosting.today and get in front of hosting buyers, founders and engineers.
50k+monthly readers
812articles