Web Hosting News & Industry Updates
Breaking news, M&A deals, pricing moves, security alerts and in-depth analysis for the web hosting industry — 812 articles across 14 categories.
✦ Featured
Software reviews
A Vercel for Africa? HOSTAFRICA’s HCode Runs in South Africa
HOSTAFRICA launched HCode on November 5 as its answer to platforms like Vercel, with prices in local currencies across six African countries. The apps run in South Africa. HCode, a rebranded version of the Zanode platform HOSTAFRICA bought in May, starts at R50, or about $3, a month.
Monarx Reviewed 65 Hosts: 10 of 12 Large Hosting Brands Sell Website Security Add-Ons
Partners #cybersecurity#monarx
Monarx's review of 65 hosting providers finds 37 including advanced website protection at no extra cost, 31 selling a separate security product and 18 doing both. Mass-market brands lean toward add-ons, while managed WordPress hosts mostly build protection into the plan.
Who Owns Europe’s Largest Hosting Markets: IONOS Controls the Leader in Germany, Poland and Spain
Industry reports #domains#europe
The four largest Swiss-owned hosts hold 39.8% of .ch domains, while the UK has one British-owned operator among its eight largest. We matched the leading operators in Europe's eight largest domain markets with their owners, and IONOS owns the leader in three of them.
DreamHost Confirms File Manager Breach. FTP/SFTP and Some Webmail Credentials Were Exposed
Security #cybersecurity#dreamhost
A security breach prompted DreamHost's October 23 File Manager shutdown and password resets. An attacker exploited third-party software behind the tool and could access FTP/SFTP credentials of users who signed in, plus some webmail logins. Well under 10% of email and FTP/SFTP accounts were affected.
All articles
101–120 of 812
Other
Cloudflare Changes Its Crawler Defaults on September 15. Sites Blocking AI Training Will Start Blocking Googlebot.
Cloudflare changes its AI crawler defaults on September 15. Crawlers that do more than one job will be judged by all of their behaviors, so sites that already block AI training will start blocking Googlebot. The new ad-page defaults reach every free-plan site left untouched.
Partners
Monarx Launches Dark Web Monitoring. One Domain Covers Every Address on It.
Monarx Dark Web Monitoring begins with a domain rather than a list of mailboxes, sells white-label at a suggested $1.99 to $9.99 a month on a 50/50 revenue share, and today shows customers which categories of their data were breached rather than the data itself.
Other
Aruba Applied for 39 TLD Strings. The Private Auction That Won It .cloud Is Now Banned.
Aruba, the Italian host that runs .cloud, told Domain Name Wire it applied for 39 strings in ICANN's 2026 round, among them vps, demo and pec. It won .cloud in a private auction, the route the new rules ban, which leaves an ICANN auction or a free switch to a fallback.
Other
Automattic’s Board Put Matt Mullenweg on Paid Leave. He Still Leads the WordPress Project.
Automattic's board has put Matt Mullenweg on paid leave, with chief financial officer Mark Davies as interim chief executive. The change stops at the commercial company: no change has been announced to his leadership of the WordPress project or to his control of WordPress.org.
Security
A cPanel Account With Mail Privileges Could Reach Root. Every Supported Version Was Affected.
cPanel has patched CVE-2026-67401. An authenticated account with mail-related privileges could create files through EmailTrack and reach code execution as root. All supported versions were affected, and the CVE record scores the flaw 9.9 out of 10, critical.
Other
Most of Hostinger’s Hardest Support Cases No Longer Transfer to a Human. The Human Coaches the AI Instead.
Hostinger has merged its support assistant Kodee with its marketing and SEO agents into Hostinger Agent. The bigger change is behind it: on the one conversation in ten the AI cannot settle alone, a specialist advises it instead of taking over, and hard-case resolution rose from 41 to 72 percent.
M&A
What Is Your Hosting Business Worth? The Smallest Deals Are Back at 2.0x.
A hosting owner reading the private-market data finds a ladder from a median of 2.0 times earnings at the bottom to 5.8 at the top. The lower rungs are quoted on the owner's total benefit and the upper ones on EBITDA, and the bottom is exactly where it stood in 2023.
M&A
Team Internet Still Wants Over $160 Million for Its Domains Business. The Timeline It Set in June Has Passed.
Team Internet's sale of its Domains, Identity and Software division is at an advanced stage with multiple parties interested in all or parts of it, the company said on September 7, holding its floor of over $160 million while the outcome it guided for in early Q3 has yet to arrive.
Industry reports
Non-Developers Are Building Whole Websites With AI. 20i’s Survey Says Only 31.5% Get a Developer’s Review.
A survey of 600 US non-developers who use AI to write code found 16.3 percent building entire websites, 61 percent testing the results themselves and 31.5 percent having a developer review the code. Separate laboratory testing puts the flaw rate near half.
Expert's Voice
Is auDA About to Nuke the .com.au Namespace? The $500 Million Red Tape Nightmare
auDA has voted to tie .com.au and .net.au eligibility to an exact match with a company name, ASIC business name or trademark. Domains registered against a product, event or trust structure would no longer qualify, and the cleanup lands on registrars and hosts.
Security
A Magento Zero-Day Is Being Exploited Now. The First Known Victim Was Fully Patched.
Attackers are running code on Magento and Adobe Commerce stores through an unpatched flaw Sansec calls StyleSmuggler. There is no patch and no CVE, the first known victim had a clean patch status, and the backdoor installs in the site user's home directory rather than the web root.
M&A
cyber_Folks Has Over PLN 1 Billion of M&A Capacity. Hosting Is Not the Priority
cyber_Folks puts its capacity for further acquisitions above PLN 1 billion and says the activity will be concentrated in e-commerce. Its hosting arm earns a 51 percent adjusted margin and a quarter of group earnings, while the segment being bought into reported an operating loss.
Security
WHMCS Has an Unauthenticated RCE. The Fix Exists Only for 9.0.8 and 8.13.7.
Two WHMCS advisories on September 3: an unauthenticated remote code execution flaw affecting every build since 8.0, and a 2CheckOut gateway flaw exposing client data in versions from 4.5. Both are fixed in 9.0.8 and 8.13.7, and nothing older gets a patch.
Partners
1,000+ Junk Emails a Day, Brought Under Control by One DNS Change
HeroicGuard filters mail before Google, Microsoft or any other provider receives it. Setup is one MX change, pricing is per domain with unlimited mailboxes, and NameHero's founder tells how it rescued a company address taking a thousand junk messages a day.
Security
Nearly Two-Thirds of All-in-One WP Migration Installs Remain Unpatched Two Weeks Later
Two weeks after the CVE-2026-19949 patch, WordPress.org statistics show 35 percent of installs on the fixed version, leaving about 3.2 million on a vulnerable version. Wordfence has published the chain from trackback to remote code execution, and Patchstack has raised its rating to medium priority.
Industry reports
Parked Domains Distort Hosting Rankings. So Do Corporate Registrars.
National hosting rankings mix five different businesses in one column. By our count, 35 of 115 markets have a domain parking service or a corporate brand-protection registrar among the eight largest names, which leaves fewer domains attributable to hosting providers than the table suggests.
Security
Attacks on the Elementor Pro Flaw Began the Day It Was Disclosed
A critical Elementor Pro flaw was disclosed on August 19 and attacked the same day, with one firewall vendor blocking more than 190,000 attempts. The fix had already shipped, only sites with a published upload form were reachable, and the check for compromise takes one look at a single directory.
Interviews
BalticNOG Interview: The Hosting Industry Is the Missing Voice in the Room
BalticNOG chairman Paulius Judickas talks to webhosting.today about the 220-attendee debut, why building a community across three countries proved harder than filling a room, what the event must never become, and the limited role hosting and data center companies play in it.
Security
A High-Severity Patch for Five Million WordPress Sites Was Labeled as a Text Fix
Two unauthenticated flaws in plugins on millions of WordPress sites were patched the same day, days before the CVE records went public. The changelogs gave no severity signal, and for anyone running a fleet, that gap is the real story.
M&A
DigitalOcean’s Market Cap Is Now Higher Than GoDaddy’s. What Five Public Multiples Say About Hosting Valuations.
GoDaddy is worth less than DigitalOcean on five times the revenue, and OVHcloud's record margin earns the lowest multiple of all. Our arithmetic on five public companies shows what actually moves a hosting valuation, and the logic transfers to private deals.
Reach hosting professionals
Sponsor webhosting.today and get in front of hosting buyers, founders and engineers.
50k+monthly readers
812articles