Changelog

Two major security incidents came to light this week. Security researchers discovered that the private keys for eight intermediate certificate authority certificates operated by eMudhra were compromised, allowing an attacker to impersonate almost any website to software that still trusts those certificates. Separately, the PHP project disclosed two critical remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619) affecting every web server running PHP 5.4 or later.

CloudCannon does not use PHP anywhere in its platform, so the PHP vulnerabilities do not affect CloudCannon or your Sites. However, PHP powers WordPress, so if you run WordPress sites outside of CloudCannon, we strongly recommend updating the PHP runtime on those servers to a patched version (8.5.12, 8.4.27, 8.3.36, or 8.2.35) as soon as possible. Attackers are already exploiting these vulnerabilities, and updating WordPress itself is not enough: the vulnerable code is in PHP, not WordPress, so the fix has to come from your hosting provider or server. If moving a site off WordPress sounds easier than updating it, reach out to our support team: we may be able to help you migrate it quickly to an Astro website.

In response to the certificate compromise, this release patched all CloudCannon services to reject the compromised certificates. The compromised certificates affect software across the whole internet, not just CloudCannon, and many tools only distrust them after a manual update. This is a great time to update your own systems: your operating system, your web browser, any installed applications and packages, and your programming toolchains.

It also addressed several issues, including those affecting Inbox permissions, SSL certificates, file tags, and snippets in rich text editors.

Fixes

• Changed Organization-level Inbox permissions to cover every Inbox in your Organization, allowing you to view, resend, and delete form submissions without also needing Inbox permissions on each Site.
• Changed the path of a new file to update whenever its data changes, instead of only when the save modal is open.
• Fixed an issue where a temporary error from our SSL provider during SSL certificate setup was shown as a permanent error. CloudCannon now retries automatically, and only shows an error if the domain is rejected.
• Fixed an issue where SSL certificate setup could request a second certificate for a domain that already had one, leaving SSL stuck on pending.
• Fixed an issue where SSL certificate checks could repeat continuously, delaying other background tasks such as domain and nameserver checks.
• Fixed an issue where a custom domain whose DNS moved during certificate validation did not show an error or a way to retry, and removed a misleading "SSL setup may have stalled" error that could appear during normal certificate setup.
• Fixed an issue where a file with unsaved changes could lose its Edited tag.
• Fixed an issue where a snippet or image at the end of a paragraph collapsed the lines of that paragraph in rich text editors.
• Updated all CloudCannon services to reject the eight compromised eMudhra intermediate certificate authority certificates.

This release addressed several issues, including those affecting the Inbox, Collection URLs, and file renaming.

Fixes

• Fixed an issue where the number of submissions in the Inbox toolbar did not update after you deleted submissions.
• Fixed an issue where deleting every submission on the last page of an Inbox left you on an empty page instead of moving you to the new last page.
• Fixed an issue where, if a file did not have all the necessary fields in its front matter, data placeholders in the Collection URL would persist into the URL value (e.g., /{permalink|if=permalink}/your-file-name/⁠). This affected the URL shown on the file's Card and the URL CloudCannon used to open the file in the Visual Editor.
• Fixed an issue where renaming a file to the path of a file you had just deleted did not label the change, so it did not appear when you saved.

This release added Component Editable Regions for Eleventy, Hugo, Vue, and Svelte, and for Sites built with React, Vue, or Svelte, including Next.js, Nuxt, and SvelteKit. It also added custom input configuration for Source Editable Regions.

It also addressed several issues, including those affecting Editable Regions, adding domains, SSL certificates, images in rich text editors, Git Provider connections, the Move up a folder action, and files incorrectly marked as new.

Features & Improvements

• Editable Regions now supports the following SSGs and frameworks, allowing you to re-render components in the Visual Editor as you edit. For more information, please read our documentation on visually editing components.
  • Eleventy, for Sites that use Liquid components.
  • Hugo. Hugo Sites install a Hugo module rather than an NPM package, and CloudCannon renders your Hugo partials as components.
  • Vue and Svelte, including Vue and Svelte components inside Astro components.
  • Next.js, Nuxt, SvelteKit, and other Sites built with React, Vue, or Svelte. These Sites use the EditableRegions component at the root of the component tree, which coordinates Editable Regions with your framework's hydration.
• Updated the Add Editable Regions to your files step of the Set up Visual Editing guide on the Site Dashboard. The Component Editable Regions section shows setup instructions for your Site's static site generator. For other static site generators, the section explains how to request support.
• Added the data-input and data-input-config attributes to Source Editable Regions, allowing you to configure the Input for a Source Editable Region by Input name or with inline JSON.

Fixes

• Fixed an issue where nested Editable Regions with absolute data paths could load before their parent Editable Region. Fixed an issue where clicking an Image Editable Region did nothing if its Input configuration was still loading.
• Fixed an issue where the Data Panel for an Image Editable Region did not update if the image element was removed from the page.
• Fixed an issue where Text Editable Regions did not correctly escape Snippets in code blocks in MDX files.
• Fixed an issue where selecting a Git Repository showed only an error if CloudCannon's access to your Git Provider account had been revoked. CloudCannon now explains the problem below the repository field and shows a Reconnect button if you have permission to reconnect your Git Provider.
• Fixed an issue where the Move up a folder action was missing for many files in a subfolder.
• Fixed an issue where an existing file with unsaved changes could show a New tag instead of Edited, and where a deleted file could be treated as a new file.
• Fixed an issue where clicking outside the documentation modal, or on parts of it, opened the documentation in a new browser tab.
• Fixed an issue where a small square appeared after an image in a rich text editor in Chrome and Safari.
• Fixed an issue where the text cursor was hard to place before or after an image or Snippet on its own line in a rich text editor. The image or Snippet now makes room for the cursor on the side you are typing.
• Fixed an issue where adding a domain that was already connected to your Organization showed a confusing error. CloudCannon now opens the existing domain, and the error for a domain connected to another Organization says so.
• Fixed an issue where a domain entered with a trailing dot, such as example.com., was treated as a different domain.
• Fixed an issue where SSL for a subdomain using external DNS was never set up or stayed on initializing. CloudCannon now retries these automatically.
• Fixed an issue where no error message appeared when an SSL certificate failed to generate because of a CAA record. The error message now explains that a CAA record on your domain or its parent domain must allow sectigo.com, or be removed.
• Updated dependencies to patch security vulnerabilities.