Join our Beta Program today

HostSecure.org - Industry News

HSC Industry Digest Weekly Recap - October 12, 2026
Weekly Recap · for the week of Oct 6 to Oct 12, 2026

WebPros raises cPanel, Plesk, and WHMCS prices up to 20% for 2027 as hosting operators weigh alternatives

Industry News - October 12, 2026

My Take

What happened WebPros announced price increases of 11–20% across cPanel, Plesk, and WHMCS effective January 1, 2027, following a 29.9% SolusVM hike and sustained annual price growth since 2019.

Why it matters to hosts For a hosting provider running shared, reseller, or VPS platforms, control panel licensing is now a material operating cost that directly affects margins and pricing flexibility—and these increases are compounding annually, forcing you to choose between absorbing the cost or raising customer fees.

What to do Audit your current cPanel, Plesk, and WHMCS spend across all your servers and tiers, then model the January 2027 cost against customer pricing to see where you have room to absorb increases and where you must decide between passing costs on or switching platforms.

My view To me this is a cost-structure problem disguised as a licensing problem. WebPros owns the three most entrenched control panels in hosting, so operators face a real switching cost—and WebPros knows it. The pattern of double-digit annual increases since 2019 suggests this is not market adjustment but extraction of trapped value. Hosting operators are right to ask whether building or migrating to open-source or lighter-weight alternatives is now worth the engineering effort.

If your hosting business margins are already tight, at what point do you start seriously evaluating a migration away from WebPros control panels, and what's your biggest blocker—engineering effort, customer friction, or vendor lock-in?

Executive Summary
WebPros pricing across cPanel, Plesk, WHMCS, and SolusVM has jumped sharply in 2026, with January 2027 increases reaching 20% on some tiers and cumulative price growth of 100% since 2019, sparking industry discussion of alternatives. A critical unpatched KVM escape vulnerability disclosed by researcher Paulos Yibelo for a $50,000 bounty is circulating in VPS hosting circles with no CVE assigned or patch available, putting every hypervisor operator on alert. WordPress 7.1.3 shipped with seven security fixes plus a critical image-upload bug affecting hosting providers running WordPress at scale.
Key Themes
Control panel cost escalation:: WebPros has raised prices annually across all its hosting management products, with 2027 increases of 11–20% now compounding existing customer backlash.
VPS and hypervisor security gaps:: A zero-day KVM escape with no assigned CVE or public patch is motivating VPS operators to harden isolation and demand transparency from virtualization vendors.
WordPress security velocity:: Critical and high-severity fixes are shipping more frequently, requiring hosting providers to patch faster and maintain tighter WordPress update workflows.
Data center infrastructure bottlenecks:: AI data center demand is straining permitting, grid capacity, and power delivery; AWS and hyperscalers are warning of $68 billion in blocked projects and regulatory friction.
DNS root key transition:: The DNS root zone completed a planned DNSKEY rollover on October 11, requiring resolvers to trust new keys or lose all name resolution.
Notable Players
WebPros (cPanel, Plesk, WHMCS, SolusVM):

Announced 11–20% price increases for 2027 across all control panel and hosting management products; SolusVM Unlimited rose 29.9% in October 2026.

WordPress:

Released version 7.1.3 with seven security fixes and one critical bug affecting image uploads; hosting providers managing WordPress-heavy deployments must patch immediately.

Jetpack:

Released version 16.3 with three new blocks, expanded features, improved accessibility, and security enhancements for WordPress site owners.

Identity Digital:

Took over .us registry operations from GoDaddy, marking the first registry operator change since Neustar won the contract in 2001.

ThisWay Global:

Acquired bankrupt RELLIS data center campus at Texas A&M and is converting it into a 73 MW AI and research facility.

Top Stories

Plesk, WHMCS and cPanel Cost Up to 20 Percent More in 2027

WebPros has published 2027 licensing guides showing 11–20% price increases for Plesk and WHMCS on every tier starting January 1, extending a pattern of sustained annual price growth for hosting operators managing cPanel, Plesk, and WHMCS infrastructure.

Vercel Paid $50,000 for a KVM Escape That Has No CVE and No Patch. Every VPS Host Is Waiting for the Write-Up.

Researcher Paulos Yibelo disclosed a full KVM escape vulnerability on October 3 that Vercel paid $50,000 to patch; the zero-day has no CVE assignment and no public patch yet, leaving every VPS and hosting operator running Linux KVM to harden isolation and wait for vendor guidance.

The DNS Root Changes Its Key on Sunday. A Resolver That Still Trusts Only the Old One Stops Resolving Everything.

On October 11, the DNS root zone completed its planned DNSKEY rollover; resolvers still trusting only the old KSK-2017 key will lose all resolution, requiring operators to verify their authoritative DNS infrastructure is up to date.

WordPress 7.1.3 Maintenance and Security Release

WordPress 7.1.3 shipped with 7 security fixes and 4 bug fixes, including a critical image-upload bug; hosting providers running WordPress at scale must update immediately to avoid customer-facing errors and security exposure.

Identity Digital Takes .us From GoDaddy. The Registry Is Down 24 Percent in a Year.

Identity Digital has assumed management of the .us country code registry from GoDaddy for the first time since Neustar won the contract in 2001, marking a significant shift in domain registry operations and signaling potential policy or service changes for .us registrars.

Security & Compliance

Exploited on Day One, Back After Cleanup: WordPress Security in 2026 for Hosting Providers

Analysis of WordPress security incidents in 2026 examining the lifecycle of exploitation and cleanup, with emphasis on detection and response workflows for hosting providers.

Attackers Target Ninja Forms and a WooCommerce Plugin to Hide a WordPress Admin

Since October 4, attackers have exploited stored XSS flaws in Ninja Forms and WPC Product Bundles for WooCommerce to inject malicious JavaScript and hide WordPress admin accounts; hosting providers should patch and audit affected sites immediately.

WordPress 7.1.3 Fixes 7 Vulnerabilities And 1 Critical Flaw via @sejournal, @martinibuster

WordPress 7.1.3 addresses seven security vulnerabilities and one critical image-upload bug; hosting providers must coordinate rapid patching across customer deployments to prevent fatal errors and security breaches.

Cloud & Infrastructure

Ukrainian drones strike largest data center in Russia, multiple parts of 1.4 million square foot campus knocked offline

A Ukrainian drone strike on Yandex's Kaluga data center has knocked multiple modules offline following a similar attack on the Sasovo facility, disrupting Russian AI and hyperscale operations.

Ukrainian drones hit Russia's Yandex data centers housing two top supercomputers

Drone strikes on Yandex Sasovo data center have put two Nvidia-powered Russian supercomputers offline, undermining Russia's AI training infrastructure and signaling geopolitical vulnerability of centralized data center operations.

Senate investigation says that some AI data center claims are misleading

A Senate investigation found that AI hyperscalers may be overstating job creation and understating costs and environmental impacts when applying for data center development permits; companies are declining to disclose supporting data.

Speed Bumps Slow Asia-Pacific's Data Center Gold Rush

Firmus and PLDT postponed data center IPOs this week while regional governments tightened permitting and development rules, marking a slowdown in Asia-Pacific's rapid data center expansion.

Permits, Not Power, Halt Google's Finland Data Centers

Despite securing northern grid access, environmental permitting rules are blocking Google's €13 billion data center expansion at two Finnish sites, illustrating regulatory barriers beyond power availability.

ThisWay Global to Convert Bankrupt RELLIS Site into 73 MW AI Hub

ThisWay Global acquired the failed RELLIS data center project at Texas A&M and is converting it into a 73 MW AI and research facility, demonstrating the Sovereign AI Blueprint for institutional AI infrastructure.

Data Center Power Demand to Grow 24% Annually by 2030: McKinsey

McKinsey projects data center power consumption will grow 24% annually through 2030, forcing operators to invest in on-site generation and raising questions about infrastructure planning beyond 2030.

Software could be the easiest fix for hyperscalers' AI power squeeze, researchers say

Researchers suggest that software optimization may be faster and cheaper than new hardware or cooling systems for managing AI data center power demand; hyperscalers are investing billions in efficiency but overlooking workload scheduling and task prioritization.

AI Power Spikes Demand Chip-to-Grid Design Changes

AI data centers' rapid power fluctuations threaten grid stability, requiring coordinated design changes across chip manufacturers, operators, utilities, and infrastructure providers.

Data center construction spending hits record $85 billion annual pace

U.S. data center construction spending reached a record $85 billion annual rate in August 2026, up 73% year-over-year, driven by AI and hyperscale expansion.

Amazon warns $68 billion in blocked data centers threatens US AI lead

AWS CEO warned that over $68 billion in data center projects face regulatory delays or opposition, and pledged a $1 billion community fund to address concerns over water, power, pollution, and jobs.

Beyond the Megawatt: Why Data Center Site Selection Is Now a Three-Front Battle

Data center permitting now requires navigating grid capacity, water use, and community benefits simultaneously; power alone is no longer the deciding factor in site selection.

Pricing & Business

VPSPioneer: DirectAdmin + CloudLinux Hosting in France Starting at $2.49/Month!

VPSPioneer is offering DirectAdmin shared and reseller hosting with CloudLinux in France starting at $2.49/month, targeting budget-conscious resellers and small hosting operators.

Control Panels

WebPros Is Killing the Hosting Industry with Endless Price Increases. Time for a Boycott?

Hosting operators on Reddit are discussing the cumulative impact of WebPros price increases across cPanel, Plesk, WHMCS, and SolusVM, with the latest SolusVM 29.9% increase prompting calls to evaluate alternatives or coordinate provider responses.

Plesk Increasing Price by Over 17%, Is it worth it?

Hosting providers questioning whether Plesk's 17% 2027 price increase justifies renewal, noting that the control panel eliminated its free tier years ago and operators are reconsidering the value proposition.

Yet Another cPanel and WHMCS Price Increase. But You're Getting More Value. Right? (Right?)

Low End Box analysis of cPanel and WHMCS price increases questions what additional value hosting operators actually receive with each annual hike, examining the cost-benefit equation for independent providers.

cPanel Will Raise Prices Again in 2027. The Licence Has Doubled Since 2019 and Is No Longer the Expensive Part of the Server.

WebPros notified cPanel partners on October 1 of 2027 price increases; cPanel licensing costs have doubled since 2019 and now rival or exceed hosting server hardware costs for smaller providers.

Acquisitions & Market

Gen Digital bid for GoDaddy: buying 81 million domains in the age of AI agents

Community discussion of Gen Digital's bid for GoDaddy, which would consolidate 81 million domain registrations and raise questions about market consolidation and competitive dynamics in domain and hosting services. --- #HostSecure

Technology & Tools

New Linux tech compresses memory in RAM, as RAM, for 452x speedup

A new Linux compression method allows in-RAM access using standard memory semantics, delivering up to 452x speedup for compressed memory reads—relevant for VPS and shared hosting environments managing memory pressure.