Web Hosting News & Industry Updates

HOSTAFRICA announced the acquisition of Zanode on May 14, 2026, nine days after acquiring Evoweb's hosting division, adding a South African git-driven deployment platform to its African hosting portfolio.

cPanel's May 13 patch covers five new CVEs, but security researcher Shubham Shah reported within hours that the fix for CVE-2026-29205 is incomplete and all cPanel instances remain exploitable until a working patch lands.

On May 8, cPanel closed three new vulnerabilities and Linux distributions shipped DirtyFrag kernel fixes. Two weeks of disclosures left providers with three separate patch tracks. Here is the complete status and the confirmations every shared hosting customer should request.

Change Healthcare's $3.1 billion in breach costs is the new normal of what a serious compromise sets in motion: parallel notification clocks across GDPR, NIS2, DORA, and HIPAA; personal liability for CISOs and boards; and a cyber insurance market with conditions that can deny coverage at the worst moment.

Hetzner, OVHcloud, Netcup, Scaleway, and IONOS raised VPS prices up to 49% in spring 2026, citing AI-driven memory shortages. Contabo launched better specs at lower prices instead. US hyperscalers posted record growth. The article maps both markets and explains which strategies survive through 2027.

The hosting industry just had a rough two weeks. cPanel, Linux, Apache, and a very clear lesson about the real risks of "semi-managed." On why the grey area between managed and unmanaged is no longer a theoretical problem: hosting.com CEO Seb de Lemos and co-founder Darren Lingham.

GDPR, CCPA, and more than 130 national privacy laws affect every WordPress site you host. From cookie consent to data residency and processor contracts, hosting providers carry more compliance weight than most realize.

On May 5, a defect in DENIC's newly deployed signing infrastructure made Amazon.de, DHL, Bahn.de, and hundreds of thousands of other .de domains unreachable for three hours. Servers were running. Monitoring showed green. The fix came from Cloudflare, not DENIC.

GoDaddy is now at the center of two AI agent identity initiatives: a Cloudflare product partnership and a 30-company HOL standards consortium. DNS is becoming the address book for AI agents, and the registrar is positioned to be the gatekeeper.

Three new cPanel vulnerabilities, CVE-2026-29201, CVE-2026-29202, and CVE-2026-29203, are being patched today at 12:00pm EST, with technical details withheld until the fix is live.

On May 7, Akamai signed a $1.8 billion, seven-year AI compute contract and surged 26% in after-hours trading. Cloudflare beat Q1 estimates with $639.8M in revenue, raised full-year guidance, and fell roughly 16% after announcing 1,100 layoffs and Q2 guidance that missed analyst consensus. Alongside Q1 results from GoDaddy, DigitalOcean, Verisign, and Tucows, the divergence reveals a clear 2026 pattern: contracted AI compute is valued over platform positioning.

DirtyFrag, a Linux kernel local privilege escalation that gives any local user root access on Ubuntu, RHEL, Fedora, CentOS Stream, AlmaLinux, and openSUSE Tumbleweed, went fully public on May 8 after an embargo break, with no CVE assigned and no patches available for any affected distribution.

Kenneth Gaughan has filed suit against InMotion Hosting and DreamHost after both canceled his ESApet.org hosting following trademark complaints from Elevate Rank LLC. The case exposes a critical legal gap: the DMCA's safe harbor covers copyright only, and hosts that cancel service over trademark complaints bypass the legal processes trademark law actually designates for resolving such disputes.

HostAfrica has acquired the hosting division of South African provider EvoWeb, the latest in a series of deals across Africa since 2016. EvoWeb retains its web design and WordPress development practice.

GoDaddy's Q1 2026 results show 13,000 net customer additions on a base of 20.4 million, with ARPU growing 9% to $246, Applications and Commerce expanding 12%, and free cash flow up 15% to $473.6 million. The numbers describe a platform that has stepped back from subscriber growth and is monetizing its existing base through AI upsells, raising a pointed question for every hosting provider watching: when the dominant SMB platform stops competing for new customers, who fills the gap and at what cost.

Extendify addresses the blank WordPress install problem that drives early hosting churn. AutoLaunch lets hosting providers create a finished site during their own signup flow, version 3.0 adds one-prompt website creation, and the AI Agent keeps customers managing their site from within WordPress rather than opening a support ticket.

Apache 2.4.67, released May 4, patches 11 CVEs including a CVSS 8.8 HTTP/2 remote code execution flaw and a shared hosting privilege escalation that lets customers read each other's files.

DigitalOcean's Inference Engine gives developers and businesses four ways to run AI inference workloads, from serverless to dedicated GPU capacity. The April 28 launch is backed by $120M in AI ARR growing 150%, a Richmond data center built for AI alone, and production deployments at Character.ai, Hippocratic AI, and LawVo.

Elementor One is a new subscription that consolidates design, AI generation, image optimization, and site management, with Angie, described as the world's first agentic AI plugin for WordPress, as its flagship component.

CVE-2026-41940, the cPanel authentication bypass exploited for 64 days before disclosure, is still developing. 44,000 servers likely compromised, a public exploit on GitHub, three active campaigns. This page is updated in real time as new information surfaces.