Changelog

This release introduced Stratus, a new documentation starter template, built with Astro and designed for editing in CloudCannon.

It also addressed issues in the Save modal, Group pages, and Subscription settings.

Features & Improvements

• Stratus became available in the list of templates when you create a new Site.

Fixes

• Removed the View As button for pending Organization Members.
• Fixed an issue where literal values in create paths were used as editable placeholders in the Save modal.
• Fixed an issue where credit was not correctly subtracted from the total cost displayed on the Subscription page.

Two major security incidents came to light this week. Security researchers discovered that the private keys for eight intermediate certificate authority certificates operated by eMudhra were compromised, allowing an attacker to impersonate almost any website to software that still trusts those certificates. Separately, the PHP project disclosed two critical remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619) affecting every web server running PHP 5.4 or later.

CloudCannon does not use PHP anywhere in its platform, so the PHP vulnerabilities do not affect CloudCannon or your Sites. However, PHP powers WordPress, so if you run WordPress sites outside of CloudCannon, we strongly recommend updating the PHP runtime on those servers to a patched version (8.5.12, 8.4.27, 8.3.36, or 8.2.35) as soon as possible. Attackers are already exploiting these vulnerabilities, and updating WordPress itself is not enough: the vulnerable code is in PHP, not WordPress, so the fix has to come from your hosting provider or server. If moving a site off WordPress sounds easier than updating it, reach out to our support team: we may be able to help you migrate it quickly to an Astro website.

In response to the certificate compromise, this release patched all CloudCannon services to reject the compromised certificates. The compromised certificates affect software across the whole internet, not just CloudCannon, and many tools only distrust them after a manual update. This is a great time to update your own systems: your operating system, your web browser, any installed applications and packages, and your programming toolchains.

It also addressed several issues, including those affecting Inbox permissions, SSL certificates, file tags, and snippets in rich text editors.

Fixes

• Changed Organization-level Inbox permissions to cover every Inbox in your Organization, allowing you to view, resend, and delete form submissions without also needing Inbox permissions on each Site.
• Changed the path of a new file to update whenever its data changes, instead of only when the save modal is open.
• Fixed an issue where a temporary error from our SSL provider during SSL certificate setup was shown as a permanent error. CloudCannon now retries automatically, and only shows an error if the domain is rejected.
• Fixed an issue where SSL certificate setup could request a second certificate for a domain that already had one, leaving SSL stuck on pending.
• Fixed an issue where SSL certificate checks could repeat continuously, delaying other background tasks such as domain and nameserver checks.
• Fixed an issue where a custom domain whose DNS moved during certificate validation did not show an error or a way to retry, and removed a misleading "SSL setup may have stalled" error that could appear during normal certificate setup.
• Fixed an issue where a file with unsaved changes could lose its Edited tag.
• Fixed an issue where a snippet or image at the end of a paragraph collapsed the lines of that paragraph in rich text editors.
• Updated all CloudCannon services to reject the eight compromised eMudhra intermediate certificate authority certificates.

This release addressed several issues, including those affecting the Inbox, Collection URLs, and file renaming.

Fixes

• Fixed an issue where the number of submissions in the Inbox toolbar did not update after you deleted submissions.
• Fixed an issue where deleting every submission on the last page of an Inbox left you on an empty page instead of moving you to the new last page.
• Fixed an issue where, if a file did not have all the necessary fields in its front matter, data placeholders in the Collection URL would persist into the URL value (e.g., /{permalink|if=permalink}/your-file-name/⁠). This affected the URL shown on the file's Card and the URL CloudCannon used to open the file in the Visual Editor.
• Fixed an issue where renaming a file to the path of a file you had just deleted did not label the change, so it did not appear when you saved.