Changelog for October 23rd, 2026

New #

• Broken Links notifications now include AI fix prompts to help you resolve issues faster.

Improvements #

• DNS and certificate checks for a site that is down now run at most once an hour.
• Status pages now include SEO meta, canonical, and hreflang tags.
• Added the October 2026 PHP incident to the uptime statistics page, which has also been redesigned.
• Slack setup instructions and the connection test message now recommend adding Oh Dear from the channel's Integrations tab, since /invite @Oh Dear doesn't always work in Slack.
• Blog posts can now include interactive charts.
• Status pages on custom domains now keep serving their certificate when the certificate service is briefly unavailable.

Security #

• We now email owners of sites running PHP versions affected by CVE-2026-109618 and CVE-2026-109619.
• Fixed a reflected XSS issue in the crawler test pages. Thanks to Shreyash Tirpude for reporting it responsibly.
• The Oh Dear CLI now restricts permissions on its stored credentials file. Thanks to Shreyash Tirpude for reporting it responsibly.

Fixes #

• Fixed duplicate "no more broken links" notifications being sent when crawls overlapped or waited in a queue.
• Fixed an issue where an inactive payment status could be cached, blocking access even after a subscription was renewed.
• Fixed customers being unable to switch plans when paying by SEPA.
• Fixed a server error when cancelling a GitHub or Google sign in.
• Fixed a server error on every page for users who signed up with Google, GitHub, or SSO after their session expired.
• Fixed a server error when connecting Slack if the connection was cancelled or had expired.
• Fixed pressing Enter on a page re-sending the last confirmed action, which could cause a server error after deleting an item.
• Fixed share images for status pages on custom domains.
• Fixed an issue where monthly reports could fail when a recipient was not a valid email address.
• Fixed horizontal scrolling on marketing pages.
• The API now returns validation errors instead of server errors for malformed date and timestamp filters, unknown teams, users without a current team, and cron check requests for monitors without a cron check.