Web Hosting News & Industry Updates
Breaking news, M&A deals, pricing moves, security alerts and in-depth analysis for the web hosting industry — 812 articles across 14 categories.
✦ Featured
Software reviews
A Vercel for Africa? HOSTAFRICA’s HCode Runs in South Africa
HOSTAFRICA launched HCode on November 5 as its answer to platforms like Vercel, with prices in local currencies across six African countries. The apps run in South Africa. HCode, a rebranded version of the Zanode platform HOSTAFRICA bought in May, starts at R50, or about $3, a month.
Monarx Reviewed 65 Hosts: 10 of 12 Large Hosting Brands Sell Website Security Add-Ons
Partners #cybersecurity#monarx
Monarx's review of 65 hosting providers finds 37 including advanced website protection at no extra cost, 31 selling a separate security product and 18 doing both. Mass-market brands lean toward add-ons, while managed WordPress hosts mostly build protection into the plan.
Who Owns Europe’s Largest Hosting Markets: IONOS Controls the Leader in Germany, Poland and Spain
Industry reports #domains#europe
The four largest Swiss-owned hosts hold 39.8% of .ch domains, while the UK has one British-owned operator among its eight largest. We matched the leading operators in Europe's eight largest domain markets with their owners, and IONOS owns the leader in three of them.
DreamHost Confirms File Manager Breach. FTP/SFTP and Some Webmail Credentials Were Exposed
Security #cybersecurity#dreamhost
A security breach prompted DreamHost's October 23 File Manager shutdown and password resets. An attacker exploited third-party software behind the tool and could access FTP/SFTP credentials of users who signed in, plus some webmail logins. Well under 10% of email and FTP/SFTP accounts were affected.
All articles
121–140 of 812
Security
An Attacker Hijacked Hetzner IP Space and Poisoned a Virtualizor Update
A BGP hijack of Hetzner address space sent Softaculous traffic to an attacker for two nights. A valid Let's Encrypt certificate hid the diversion, update packages were not cryptographically verified, one malicious Virtualizor update got through, and the countermeasure took about 12 hours to arrive.
Other
Proton’s Frankfurt Outage Report: 20 Minutes to Critical, and Hardware Too Scarce to Sacrifice
Proton's outage report is direct about what went wrong: a night-time filter change on both compressors killed the cooling, AI-era density cut the time-to-critical from hours to 20 minutes, and engineers chose to power servers down rather than lose hardware the AI boom has made hard to replace.
Pricing updates
Verisign Lifts .net Wholesale From $10.91 to $12.00, Effective March 1, 2027
A one-line 8-K raises .net wholesale from $10.91 to $12.00 from March 1, 2027, the first increase since February 2024. With 12.5 million registrations renewing at 78.7%, the step is worth up to $13.6 million a year, and resellers have six months to reprice.
Security
cPanel Patches a Root-Level Flaw in Domain Parking: One Customer Account With Domain Permissions Was Enough
cPanel patched CVE-2026-65643: an account holder able to add parked or addon domains could create arbitrary files and reach root, taking every site on the server. All supported versions were affected. No CVE record, no CVSS and no exploitation status published so far.
Events
Atlas Digital Summit Debuts in Reykjavik: Two Days on What AI Does to the Hosting Business
A 1927 Reykjavik theater hosts the first Atlas Digital Summit on September 28-29: two keynotes, six executive roundtable blocks in parallel Hosting and Security tracks, curated by Jason Nickerson of Domain Days Dubai. Invite-only, C-level, with AI as the thread through every session.
Pricing updates
Melbicom Prices Its Premium CDN by Zone: EUR 0.03 per GB in 55 Territories, Up to 0.15 Elsewhere
Melbicom's new CDN pairs a 39-PoP Premium network with a 12-PoP Volume lane reaching EUR 0.002 per GB. The zone map sets Premium's destination rate: 55 territories at the entry 0.03, delivery to the other 196 costs more. Cache-fill is free, the company told us; the published terms state no SLA.
Industry reports
In Wix’s Report, .store Doubled and .ai Cracked the Top 10. Zone Files Rank Them 24th and 39th
Wix says .store doubled and .ai cracked its top ten. Our zone data ranks them 24th and 39th while .com holds 45.6%, and registry estimates have .shop renewing at 14.2% against .com's 74.9%. Fast growth, faster churn, and the same incumbent.
Events
A Month Before Riga: What the First BalticNOG Delivered in Vilnius
The first BalticNOG put Geoff Huston's encryption doubts and Ukraine's wartime network lessons on one Vilnius stage. A month before Riga, that program is the best argument for going. Our co-founder was there; this year we watch from afar.
Industry reports
Seventeen Providers, Five Ways to Bill AI, and a Credit That Means Three Things
AI billing at 17 providers runs on five recurring mechanisms, often combined in one product. At one pole a provider publishes examples of what its credits buy; at the other, a subscription defines no unit at all and reserves additional charges or suspension for excessive use.
Other
Namecheap’s Second Hosting Outage This Month Hits 78 Shared Servers
Namecheap's second hosting outage in 13 days hit 78 shared servers on August 26 and was resolved after two hours and twenty minutes of status updates. Unlike the Phoenix cooling failure, this one ended with no cause given.
Security
InMotion Rolls Out Monarx ThreatShield Inside the PHP Engine Across Its Fleet
InMotion is switching on Monarx ThreatShield fleet-wide, blocking attacks inside the PHP runtime rather than filtering requests in front of it. Its own July incident report, with two sites taken over in under half a minute each, documents the problem this product class targets.
Security
Plesk Patches Three Flaws That Start From an Ordinary Customer Account
Plesk's August 25 advisories cover three flaws reachable from an ordinary customer account: arbitrary file reads, cross-tenant database access, and root through two extensions. The extension fixes ship separately, and administrators report the Migrator update is not arriving.
Industry reports
Five Registrars, Half the Blocklisted Domains, and a Dispute Over the Count
Interisle counts 8.5 million of 2025's 85 million new gTLD domains on blocklists, with five registrars accounting for half of them and rates ranging from 3% to 88%. ICANN's scientists dispute the scale and the method, while two policy processes target the bulk registration the report documents.
Software reviews
Hostinger’s AI Builder Exports the Code, While the Database Stays
Hostinger has merged its two builders into AI Builder, where the AI provisions the backend rather than recommending one. Asked what customers can take elsewhere, the company told us the codebase exports while the database stays. Its own documentation adds that the export is one way.
Stock reports
GoDaddy Is Sued Over the .com Promotion That Worked Too Well
A securities complaint alleges GoDaddy told investors it had turned off front-of-funnel discounting while running a $4.99 one-year .com offer. Its own filings show domains under management rising in that quarter and bookings growth falling from 9.1% to 5%.
Events
What WebHosting.Today Learned at WordCamp US 2026
WordCamp US 2026 drew close to 1,200 people to Phoenix, more than a third of them first-timers, and shipped 21 contributions in a reimagined Contributor Day. Porkbun, Hosting.com, BigScoots and CloudLinux told us how they are handling AI and faster threats, and what brings them to events.
Pricing updates
Clientexec Will Enforce Its Update Window, and the First Upgrade Is the One That Fails
Owned Licenses came with one year of updates that Clientexec says it never strictly enforced, in one case for twenty years. Enforcement starts at 7.2.1, and because the eligibility check ships inside that release, it is the one upgrade that fails rather than refusing.
Industry reports
GoDaddy Launches Node.js Hosting, and Publishes the Rules Apps Must Follow
GoDaddy's Node.js Hosting runs applications as persistent processes on plans that already exist, at a flat price. Its published deploy contract sets the limits that decide fit: outbound traffic on ports 80 and 443 only, no external databases, and no outbound SMTP.
Security
Researchers Found Six Major CDNs Vulnerable to New HTTP/3 Attacks. Two Deployed Mitigations.
New research turns a CDN against the site behind it by exploiting the gap between HTTP/3 at the front and HTTP/1.1 at the back. All six CDNs tested were vulnerable, only Baidu and Tencent have deployed mitigations, and every proposed fix sits at the CDN rather than at the site.
Security
Forminator’s 9.8 Flaw, and Eleven More Fixes in Nineteen Days
Forminator's file upload flaw scores 9.8 and needs no authentication, but it takes a form with both an upload and a select field, and the default .htaccess meant to stop execution does nothing on NGINX. The changelog records twelve security releases in nineteen days.