The security issues that were dealt with require having login details to your phpList installation. Therefore they are not exploitable by unknown outsiders, which makes the threat a little less. Nevertheless we advice everyone to upgrade to the latest stable version. In general that's a good idea with any software you use.O

Go to the download page

We've released a new stable version of phpList, 2.10.14

This version fixes several bugs and a security vulnerability. Everyone running the 2.10 versions or before is strongly advised to upgrade to this version.

Changes in this version can be found in the changelog page , as generated by Mantis.

Many thanks to all involved, for reporting the issues, and helping to resolve them.

We have released a new stable version of phpList, version 2.10.13. This version is a further update on security, removing a few potential security vulnerabilities and further hardening the application against malicious attacks.

We have not heard of any instances where these vulnerabilities have been exploited, and we hope it stays that way.

We're very pleased to announce the release of a new development version of phpList. To get your copy, go to the Sourceforge Download page .

Main changes in this version: UTF-8 support.O

This version can also handle sending your campaigns with the Amazon SES service.

Our hosted newsletter service already runs on this version, but to declare the download version stable, we want to add some finishing touches first, particularly in the UI and internationalisation side of the application.O

As always with development versions, it's for the bold and brave. Be careful, backup often and report issues you find in our bugtracker .

Before we are able to consider this version stable, quite some testing will need to be done. For example, we haven't really tested upgrade to this version from the latest stable. If you want to help out, please play with it, and report your findings in mantis , marking the issue for version 2.11.5

This version has quite a large amount of changes. Below we are giving a summary of what has changed, but in fact loads more changes have been made. The most important change to keep in mind that phpList will no longer work with PHP4.

WebReference has published an article on how to setup, manage and even hack phpList. This mostly applies to phpList when you download it to your own server. Our phpList Hosted service has phpList all installed and configured.

"Find out how to set up -- and when necessary, hack -- phpList on your
server to get the most out of this popular email campaign manager."
http://www.webreference.com/authoring/email/phplist/

This release is aimed at hardening the security in phpList. Several changes have been made to eliminate potential attack vectors.
It also includes:

• Some bug fixes

• Internationalization additions

• Re-enable image upload in fckeditor

• Improves mime encoding to avoid attachment corruption

It is mainly a minor release, but we wanted to make this fixes available.
For more information please visit the mantis changelog page.

Upgrading your current version

• Unpack the new packaged version into a new "lists" directory.
• Try it out.

• Backup the database (this might not be needed if you are upgrading from 2.10.9)
• Then update it as mention on the admin page (there is a link once you update).

• Once you feel confortable you can move the old code into a new directory and rename this new one with the old name.

Once that is ready the new version is available for the public into the URL you were using.

Please go to the forum if you have questions.

Cheers,

phpList Team

Everyone using any version up to this one is advised to upgrade as soon as possible. Any clients hosted by Tincan have already been patched or upgraded.

We want to thank Paul Myatt for reporting this vulnerability and handling the issue in a responsible manner.

We hope you enjoy it, and that it serves the phplist community better! Now you can quickly and easily find and navigate between the online documentation wiki, the forums, issue tracker, and other general information.