Web Hosting News & Industry Updates
Breaking news, M&A deals, pricing moves, security alerts and in-depth analysis for the web hosting industry — 812 articles across 14 categories.
✦ Featured
Software reviews
A Vercel for Africa? HOSTAFRICA’s HCode Runs in South Africa
HOSTAFRICA launched HCode on November 5 as its answer to platforms like Vercel, with prices in local currencies across six African countries. The apps run in South Africa. HCode, a rebranded version of the Zanode platform HOSTAFRICA bought in May, starts at R50, or about $3, a month.
Monarx Reviewed 65 Hosts: 10 of 12 Large Hosting Brands Sell Website Security Add-Ons
Partners #cybersecurity#monarx
Monarx's review of 65 hosting providers finds 37 including advanced website protection at no extra cost, 31 selling a separate security product and 18 doing both. Mass-market brands lean toward add-ons, while managed WordPress hosts mostly build protection into the plan.
Who Owns Europe’s Largest Hosting Markets: IONOS Controls the Leader in Germany, Poland and Spain
Industry reports #domains#europe
The four largest Swiss-owned hosts hold 39.8% of .ch domains, while the UK has one British-owned operator among its eight largest. We matched the leading operators in Europe's eight largest domain markets with their owners, and IONOS owns the leader in three of them.
DreamHost Confirms File Manager Breach. FTP/SFTP and Some Webmail Credentials Were Exposed
Security #cybersecurity#dreamhost
A security breach prompted DreamHost's October 23 File Manager shutdown and password resets. An attacker exploited third-party software behind the tool and could access FTP/SFTP credentials of users who signed in, plus some webmail logins. Well under 10% of email and FTP/SFTP accounts were affected.
All articles
81–100 of 812
Industry reports
Brussels Will Grade Data Centres From A to G on Power and Water.
The European Commission adopted a delegated regulation on September 21 that turns the figures data centers of 500 kW and up already report into a public A to G label for power and water use. First labels are due by August 15, 2027, and the average PUE reported so far is a D on that scale.
Security
cPanel Patches a Root Escalation That Starts From an Ordinary Hosting Account
cPanel patched a privilege escalation running from an ordinary hosting account to root, plus a WP Toolkit flaw reaching other accounts' databases. Three builds shipped September 22, no severity score is published, and one researcher is credited on four root-level flaws across cPanel and Plesk.
Industry reports
ICANN Confirms 1,616 gTLD Applications Proceed. Reveal Day Expected by October 14.
ICANN's September 22 count puts the 2026 gTLD round at 1,616 paid applications out of 1,663, smaller than 2012's 1,930. Reveal Day is due by October 14, the schedule promised for mid-September is now promised for the week of September 28, and contention will be settled without private auctions.
Software reviews
Ask nginx Which Config It Is Running. Not Every Build Will Answer.
nginx can now be asked which configuration it is actually running, a question that had no answer before 1.31.5, and a reload now returns an HTTP status code with the logs attached. The Control API came out of the paid NGINX Plus release, and it ships with no authentication of its own.
Other
GitHub, Salesforce and SharePoint Went Down in Four Days. Nobody Attacked Them.
A GitHub cleanup job saturated the database behind every authenticated request. A Salesforce legacy login service stalled during Dreamforce. A Microsoft configuration change blanked SharePoint pages. Three platforms, four days, and trouble that started inside a shared service path.
Security
WordPress 7.1.1 Fixes a Comment-Form XSS. The Payload Passes the Sanitizer.
WordPress 7.1.1 fixes CVE-2026-93485, a stored XSS delivered through the ordinary comment form by an anonymous visitor and missed by wp_kses. Two of the other ten fixes came from Anthropic, and three in ten sites run a version 6 branch reached only by a backport.
Industry reports
Verisign Will Delete 22,000 .name Domains That Are Paid For. Two Registrants Are Fighting It.
Verisign has ICANN's permission to delete every third-level .name domain in existence, the john.smith.name form the registry launched with, along with the email forwarding service that let a registrant receive mail at [email protected].
Security
A Critical libheif Bug Reachable Through WordPress Uploads Still Has No CVE
A researcher uploaded a crafted photo to a clean WordPress site and left a working PHP file on the server. The flaw is in libheif, a system library that arrives with the operating system, and twenty days after the fix shipped it still has no CVE number for patch pipelines to match.
Security
Three LiteSpeed Security Builds in Six Days: Check Which One Your Servers Run
A cPanel advisory of September 14 covers a LiteSpeed Enterprise flaw that lets a hosting account past CageFS to root. LiteSpeed has since shipped 6.3.7 three times in six days, each build with a security change, and a server patched on the day of the advisory is no longer on the latest one.
Industry reports
AWS Cannot Restore Access to Data Kept Only in Bahrain or One UAE Zone
Six months after both regions were damaged, AWS cannot restore access to resources and data hosted exclusively in Bahrain or in one UAE zone. Most customers migrated in time. For the rest, the only copy that counts is the one kept outside the region.
Security
Acronis cPanel Backup Plugin: Exploited Privilege-Escalation Flaw on CISA’s List
Acronis has patched CVE-2026-87886 in its backup plugin for cPanel and WHM and says it has been used in limited, targeted attacks, based on one customer report. CISA added it to its Known Exploited Vulnerabilities catalog on September 16 with a three-day deadline for US federal civilian agencies.
M&A
Before the Press Release: What We See in Hosting M&A
Many owners who ask what their hosting business is worth have not decided to sell. Beyond the thirty deals announced in the first half of 2026 sit owners testing valuations, buyers with precise criteria, and conversations that run for months before anything becomes public.
Other
Elementor Opens an MCP Beta to Claude, Codex and Cursor
Elementor, on more than ten million sites, has opened a beta letting Claude, Codex, Cursor and other MCP tools build pages as native Elementor structures. It runs on atomic pages, output stays a draft, and three of the nine capabilities need a second Elementor plugin.
Security
Ten IP Addresses Sent at Least 94,000 Attempts to Exploit a WooCommerce Plugin.
A critical file-upload flaw in a paid WooCommerce extension was disclosed in February, and Wordfence has since blocked more than 100,000 attempts to exploit it. The largest published spike came on August 30, and ten source addresses account for at least 94,490 of the blocked requests.
Industry reports
We Ranked Hosting Two Ways. We Resolved 108 GoDaddy Domains: 96 Point at Amazon.
Ranked by domains on their nameservers, GoDaddy leads with 73.1 million. Ranked by hosting attribution it falls to 3.5 million, but that column records whose address space a site is served from. We resolved a sample of GoDaddy's domains: 89% land in blocks registered to Amazon.
Partners
Why Unfinished Websites Are Costing Hosting Companies More Than They Think
An agency founder spent eighteen years being paid to finish websites for people who had already bought hosting elsewhere. He argues that customer was the host's first, that the loss rarely looks like a loss, and that support tickets are full of requests hosts currently turn away.
Other
auDA Backs Removing a .com.au Allocation Route. Domain Monetization Stays Allowed.
auDA approved in principle a recommendation deleting the clause that lets a .com.au domain match a service, goods or premises. In the same package it kept domain monetization allowed, a pairing the panel's minority calls inconsistent. No rule has changed yet.
Security
EU Software Makers Now Have 24 Hours to Report an Exploited Flaw.
Article 14 of the Cyber Resilience Act took effect on September 11, giving manufacturers 24 hours to file an early warning on an actively exploited flaw. License is not the test, monetization is, and the equivalent duty for open-source stewards does not begin until December 2027.
Stock reports
IONOS Is Cutting 12% of Its Workforce Five Weeks After Raising Its Revenue Outlook.
IONOS will reduce headcount from about 3,800 to about 3,350, spending around EUR 35 million once to save up to EUR 30 million a year from 2027. IONOS says the savings will be reinvested, including in AI product development and cloud, and its 2026 adjusted EBITDA forecast is unchanged.
Other
group.one’s Ask Aida Completed 95% of Tasks in Customer Testing. Three Areas Still Required Human Support.
In initial customer testing, Ask Aida completed 95% of tasks. Authentication, some external invoicing and abuse cases still required human support.