Web Hosting News & Industry Updates
Breaking news, M&A deals, pricing moves, security alerts and in-depth analysis for the web hosting industry — 811 articles across 14 categories.
✦ Featured
Industry reports
Most Domains Leaving Hostinger and Namecheap DNS Go to Expiry Pages, Not Rivals
The largest destination for domains leaving Hostinger's and Namecheap's name servers was not a rival but the expiry pages each company uses: about 64% and 70% of the outflow in the period to October 24, by our count. ICANN's rules for expired domains explain how such moves happen.
Who Owns Europe’s Largest Hosting Markets: IONOS Controls the Leader in Germany, Poland and Spain
Industry reports #domains#europe
The four largest Swiss-owned hosts hold 39.8% of .ch domains, while the UK has one British-owned operator among its eight largest. We matched the leading operators in Europe's eight largest domain markets with their owners, and IONOS owns the leader in three of them.
DreamHost Confirms File Manager Breach. FTP/SFTP and Some Webmail Credentials Were Exposed
Security #cybersecurity#dreamhost
A security breach prompted DreamHost's October 23 File Manager shutdown and password resets. An attacker exploited third-party software behind the tool and could access FTP/SFTP credentials of users who signed in, plus some webmail logins. Well under 10% of email and FTP/SFTP accounts were affected.
GoDaddy Q3 2026: Domains Lifted Its Core Segment. The Rest, Including Hosting, Fell $7.4M
Industry reports #airo#domains
GoDaddy's revenue rose 6% to $1.342 billion in Q3 2026. Inside Core, domain revenue rose $40.6 million, while revenue outside domains, where GoDaddy books standalone hosting and security, fell $7.4 million and has declined in every quarter of 2026.
All articles
21–40 of 811
Security
WordPress 7.1.4 Fixes 22 Flaws, One in the Core Update Process
WordPress 7.1.4 fixes 22 vulnerabilities, including a race condition during core updates that could lead to remote code execution. It is the fourth 7.1 point release in six weeks, and the fixes reached every older branch back to 4.7 the same day.
Interviews
Cloudways’ Ali Khan on Velocity: Scaling, Pricing and Node.js Upgrades
Cloudways argues that AI is making website demand harder to predict. Its Velocity Node.js hosting runs on persistent servers with flat plan prices and no CPU or RAM autoscaling. Ali Khan explains how it differs from DigitalOcean's App Platform and how it handles resource limits.
Security
LiteSpeed Cache Flaw Can Leave Admin-Level REST Data Exposed for a Week
LiteSpeed has published an advisory for a LiteSpeed Cache flaw that, on sites with a specific setup, can let unauthenticated attackers retrieve admin-level data. The fix shipped in 7.9.1 on September 1, and an exposed response stays cached for seven days by default unless purged manually.
Security
Japan’s GMO Refuses Ransom After VPS Breach and Offers $1 Million Bounty
GMO Internet will not restart its breached Onamae.com Desktop Cloud platform in its current form. The Japanese provider refused a ransom demand of $50 million and will compensate customers, while GMO Internet Group launched a reward of up to $1 million on October 28.
Pricing updates
GoDaddy’s v3 API Offers $14.99 .com Renewals, but Only With Auto-Renew On
GoDaddy publishes a separate price list for domains bought through its v3 API: a .com registers for $9.79 and renews for $14.99 with auto-renew on, against a standard rate of $22.99. Turn auto-renew off and renew manually, even through the API, and the standard rate applies.
Industry reports
PHP2Shell Timeline: How the Hosting Industry Reacted
PHP2Shell advisories went public at 13:34 UTC on October 21. Edge rules came first and distributions shipped fixed builds the same day, while some shared hosting waited overnight for CloudLinux. A third flaw and a KEV listing followed within days.
Events
From GoDaddy to Blacknight: 10 Hosting Sessions to Watch at CloudFest Americas
CloudFest Americas opens in Miami on November 11, with 2,000-plus attendees expected. Several of its hosting sessions ask what is left of web hosting as a product once AI lets customers build without choosing a host, and our top 10 includes a Blacknight and Your.Online panel on their deal.
Industry reports
OVHcloud Links Record Daily Domain Sales to Vibe Coding, but Web Revenue Grew 3.2%
Domain name sales at OVHcloud are reaching record daily volumes, which the company links to vibe coding and AI. Revenue grew more modestly: Webcloud, its segment for domains, web hosting and email, rose 3.2% like for like to €199.7 million in FY2026.
Industry reports
Hosting Churn Starts Long Before the First Renewal
At .com and .net, first-time renewal rates are almost half those of later renewals, and Hostinger sees a similar pattern in its VPS business. Much of what decides whether customers stay is set earlier, by the billing term, early use of the service and failed payments.
Software reviews
Hostinger Now Shows If a DDoS Attack Took a Shared Hosting Site Down
Hostinger has added a dashboard page that shows shared web hosting and cloud hosting customers whether a DDoS attack made their websites unreachable. It lists each attack that reached a plan's IP addresses, with the websites affected, when it started and ended, and its impact.
Security
DreamHost Urges Affected Owners to Reset Every Email and FTP Password
DreamHost's File Manager was offline from October 23 to 26. The host expired email and FTP/SFTP passwords that may have been exposed and asks affected account owners to set new ones for every user and to check mailboxes for unknown forwarding rules.
M&A
team.blue Extends €1.1 Billion of Its Term Loan B to 2032
team.blue has extended €1.1 billion of its €1.35 billion Term Loan B from September 2029 to July 2032, leaving about 90% of its term debt due in 2032. The deal launched at a minimum of €500 million and was upsized twice on lender demand.
Industry reports
Verisign: Record 13.1 Million New .com and .net Names as Growth Speeds Up
Verisign added a net 3.36 million .com and .net names in the third quarter and processed a record 13.1 million new registrations. Growth has picked up for four quarters in a row, and Verisign's 10-Q credits registrar marketing and "the evolution of AI tools used in content and website creation."
Industry reports
Beyond Server Space: Large Hosting Providers Are Turning Into Small Business Platforms
Hostinger no longer calls itself only a hosting company, GoDaddy puts Airo at the center of a company-wide AI transformation and group.one names a shift from hosting to SaaS. What five hosting providers now sell beyond server space, and what their own figures show.
Security
Infinity Core: Six Linux Kernel Bugs, Five Root Exploits, Uneven Fixes
Infinity Core, six vulnerabilities in core Linux kernel code disclosed October 16, includes five whose public exploits gained root on tested systems. On a hosting server, the local attacker can be anyone who has compromised a site. Fixed kernels are reaching some distributions.
Other
auDA Proposes Exempting Nearly 3.5 Million Existing .com.au and .net.au Domains From New Allocation Rules
Under a new proposal, auDA would let existing .com.au and .net.au licenses continue under today's allocation rules if it tightens them, and no current registrant would be affected. No final decision has been made, and a public consultation is planned for later this year.
Security
Two Critical PHP Flaws Leaked Ahead of the October 21 Security Release
The PHP project has scheduled a security release for two critical flaws, each rated 9.2 under CVSS v4.0, for 14:00 UTC on October 21. Information leaked the day before, and CERT-EU identifies the flaws as CVE-2026-109618 and CVE-2026-109619.
Security
OVHcloud CLI Downloads Carried a Secret Stealer for Up to 94 Minutes
On October 19, for up to 94 minutes, the download files of five OVHcloud CLI releases contained a binary designed to retrieve secrets from disk. According to OVHcloud's CEO, the attacker used a developer's GitHub account. OVHcloud deleted the files and published a new, immutable v0.16.0.
M&A
After More Than 60 Acquisitions, Your.Online Backs a Trust Services Company Built From Scratch
Your.Online, a Dutch group with more than 60 acquisitions since 2017, is backing a new trust business built from scratch rather than buying one. Invicta Trust Services focuses on qualified trust services under eIDAS and is led by Patrick Beckman Lapré, who joins from QuoVadis.
Other
Mullenweg Retook Automattic in 33 Hours. The Board That Put Him on Leave Is Gone.
Mullenweg's paid leave lasted 33 hours and 20 minutes. He is back as Automattic's chief executive, the directors who voted to sideline him have left, and a new board is in place. Fortune's reconstruction points to divisions over the WP Engine case, but no former director has explained the vote.
Reach hosting professionals
Sponsor webhosting.today and get in front of hosting buyers, founders and engineers.
50k+monthly readers
811articles