# Changelog for October 23rd, 2026

AI fix prompts in Broken Links notifications, PHP vulnerability alerts, security fixes, and many reliability fixes.

## New
* Broken Links notifications now include AI fix prompts to help you resolve issues faster.

## Improvements
* DNS and certificate checks for a site that is down now run at most once an hour.
* Status pages now include SEO meta, canonical, and hreflang tags.
* Added the October 2026 PHP incident to the [uptime statistics page](https://ohdear.app/uptime-statistics), which has also been redesigned.
* Slack setup instructions and the connection test message now recommend adding Oh Dear from the channel's Integrations tab, since `/invite @Oh Dear` doesn't always work in Slack.
* Blog posts can now include interactive charts.
* Status pages on custom domains now keep serving their certificate when the certificate service is briefly unavailable.

## Security
* We now email owners of sites running PHP versions affected by CVE-2026-109618 and CVE-2026-109619.
* Fixed a reflected XSS issue in the crawler test pages. Thanks to [Shreyash Tirpude](https://www.linkedin.com/in/shreyash-tirpude-7782a31b4/) for reporting it responsibly.
* The Oh Dear CLI now restricts permissions on its stored credentials file. Thanks to [Shreyash Tirpude](https://www.linkedin.com/in/shreyash-tirpude-7782a31b4/) for reporting it responsibly.

## Fixes
* Fixed duplicate "no more broken links" notifications being sent when crawls overlapped or waited in a queue.
* Fixed an issue where an inactive payment status could be cached, blocking access even after a subscription was renewed.
* Fixed customers being unable to switch plans when paying by SEPA.
* Fixed a server error when cancelling a GitHub or Google sign in.
* Fixed a server error on every page for users who signed up with Google, GitHub, or SSO after their session expired.
* Fixed a server error when connecting Slack if the connection was cancelled or had expired.
* Fixed pressing Enter on a page re-sending the last confirmed action, which could cause a server error after deleting an item.
* Fixed share images for status pages on custom domains.
* Fixed an issue where monthly reports could fail when a recipient was not a valid email address.
* Fixed horizontal scrolling on marketing pages.
* The API now returns validation errors instead of server errors for malformed date and timestamp filters, unknown teams, users without a current team, and cron check requests for monitors without a cron check.