phpList 3.6.15 released: includes security enhancements


A new version for phpList is now ready for download, introducing several changes.

This release includes security enhancements.

You can get a copy of the RC version from GitHub or SourceForge.

Changes to look for

  1. Added support for indicating and getting feedback for test campaigns. With this PR, a “Test” subject indicator will be appended to test campaigns. See Pull Request #1031.
  2. Allow subscribers to be filtered by confirmed and/or blacklisted. See #Pull Request 1030.
  3. Added “Bounces” subscriber status indicator and allow admin to confirm a subscriber right from the Bounces tab. See Pull Request #1029.
  4. Added “bouncemgt” to allow processing only existing bounces and a related new rule action. See Pull Request #1028.
  5. Use the utf8mb4 charset for client-server exchanges. Using utf8mb4 will allow a wider range of characters, including emoji characters, to be sent. If once-off database table changes are made, subject lines can include emoji characters. This change is backward compatible; it has no effect when supplementary characters are not used. See Pull Request #1001.
  6. Allow Ajax page links to have a title, defaulting to the link description. The title is shown when hovering over the link. See Pull Request #1002.
  7. Add a notification by email when an admin logs in from a new IP address. See Pull Request #1027.
  8. Escape the single quote in the error message returned by allowMessageToBeQueued(). See Pull Request #1003.
  9. Update the CI to remove old PHP versions and add 8.3. See Pull Request #1004.
  10. Restore the ability to create other superusers. See Pull Request #1014.
  11. Define timestamp columns explicitly. See Pull Request #1019.
  12. Remove redundant upgrade steps. See Pull Request #1020.
  13. avoid the admin being kicked out after the upgrade. See Pull Request #1033.
  14. Update the Common and Segment plugins. See Pull Request #1024.
  15. Updated translations in French. See Pull Request #1032.
  16. Use the list order, even when grouping by category. See Pull Request #1025.
  17. Updated the UUID class to the latest upstream. See Pull Request #990.
  18. Additional PHP 8 fixes. See Pull Request #1026.
  19. Removed obsolete references for Mantis, the old bug tracker. See Pull Request #994.


With the new changes added, more strings are available for translation. Check out the new strings on Weblate, and help bring phpList into your language. If you are not sure where to start, have a look at this blogpost. Fixes & new translations.


This release is the work of @lwcorp, Duncan Cameron and other Open Source community members who have submitted Pull Requests, bug reports, and valuable feedback, as well as phpList Ltd. developers. To get involved in phpList development, check out the developer resources pages.

Report any issues you find with phpList 4 core or REST API  to the corresponding repo on GitHub. Please read the contribution guide on how to contribute to these modules.


Need help upgrading your phpList server to the newest version? Ask the community at Professional support from community experts, as well as manuals, source code, and developer resources, can be found at Report all bugs to the phpList3 GitHub repository.

Want to focus on campaigns and forget hosting headaches? Sign up at for an account with everything included. Send from 300 free messages to 30 million messages per month — simple.

Leave a Reply