Updated the bundled nginx rules. If your server runs nginx and includes the .nginx.conf file, reload nginx after updating so the new rules apply. If you copied its contents into your own server configuration instead, copy the new rules across and reload nginx. Until then, the extra protection for the uploads folder is not active on nginx.
Fixed a security issue with files received over WhatsApp: only common image, video, audio, PDF, Office, text and CSV files keep their original type, and any other file is now saved as a generic .bin file.
Fixed a security issue in the uploads folder: files stored there can no longer be run as programs on Apache servers, including requests that append extra text after the file name.
Fixed a security issue when creating or editing WhatsApp auto-replies.
Improved the bundled WhatsApp server so received documents are only saved under a known file type.
Fixed failed pushes to Android gateway phones going unrecorded. When Zender cannot reach a paired phone, whether to make it fetch queued SMS or USSD requests or to deliver a push notification sent from the admin panel, for example because your Firebase key was revoked or a phone's push token is out of date, the reason is now written to the error log, so messages stuck as "Pending" can be diagnosed. Repeats of the same error are recorded at most once an hour.
Fixed a damaged Firebase Credentials file making SMS sends and the scheduled sender job stop with an error page. They now carry on, and the error log names the Firebase credentials as the cause.
Updated the WhatsApp server to the latest WhatsApp library for continued compatibility.
Updated the documentation with a troubleshooting entry for SMS that stays "Pending" while the gateway app reports no messages to process, and corrected the checkout message the Plugins page tells you to expect when the exchange rate key is missing.
Fixed high-priority WhatsApp messages sent through Quick Send, the OTP API, auto-replies and flows staying "Pending" forever when the WhatsApp server could not be reached or the WhatsApp account was not connected. They are now marked "Failed". These messages also no longer make the system contact the WhatsApp server for nothing on every scheduled run — including messages already stuck before this update, which otherwise keep their "Pending" status.
Updated the WhatsApp server to the latest WhatsApp library for continued compatibility.
Fixed flow conditions that include an apostrophe, quotation mark, ampersand or angle bracket never matching incoming messages. If you worked around this by typing a code such as ' into a condition, change it back to the plain character, as the code form no longer matches after this update.
Fixed "Not Contain" flow conditions that include one of those characters firing on the very messages they were meant to exclude.
Fixed WhatsApp messages containing an apostrophe, quotation mark, ampersand or angle bracket being delivered with codes such as ' or & in place of the character.
Fixed Admin → Overview → System failing to open, and its currency and realtime settings not saving, on sites where the 3.10.0 update did not finish. The missing settings are now restored automatically.
Fixed device pairing not working, and the protection against the same payment being credited twice being missing, on sites where the 3.10.0 update did not finish. This update restores both.
Fixed the WhatsApp server source code included in the download failing to compile, and self-built copies such as the Windows build reporting their version as 0.0.0-dev.
Updated the Flow Builder documentation to explain how Regex conditions match: a value without delimiters such as /…/ is matched as plain text, not as a pattern.
Fixed a security flaw that let any signed-in account delete every voucher and every marketing record on the site, no matter who owned them. Deleting your own messages and contacts is unaffected.
Fixed social sign-in treating an unverified email address as proof of identity. Signing up at a provider that hands back an unverified address could attach that login to somebody else's existing account.
Fixed gateway callback addresses being generated from a predictable value. That address is the only thing guarding a gateway's delivery callback, so a guessed one could mark a message delivered and bill the sender for it. Existing gateways keep the address they already have.
Fixed WhatsApp pairing tokens and admin-created API secrets being generated from a predictable value. Both act as credentials, so a guessed one could be used in place of the owner's key.
Fixed payout approvals, message resends and translation saves being triggerable by a crafted link that a signed-in administrator clicked.
Fixed a device's message-fetch request passing an unchecked value straight into a database query.
Fixed unsubscribe links telling recipients they had opted out when nothing was recorded. Some mail clients rewrite the link in a way the old page could not read, so the person kept receiving messages after being told they had left the list.
Fixed a gateway saved without a per-country price list stopping scheduled messages for every customer on the site, not only for that gateway.
Fixed an installed plugin whose details file omits its version taking down every dashboard page, for every user, rather than just that plugin.
Fixed the plugin settings screen and the plugin update showing a general error page instead of opening, or instead of finishing after the files had already been replaced.
Fixed the subscription-expiring reminder email, which had never been sent on any install.
Fixed EasySendSMS being sent the sender name in place of its password, and ClickSend being sent the API key in place of its username, so neither could authenticate with what the customer had entered.
Fixed package limits accepting a negative number and silently treating it as unlimited.
Fixed a failed save leaving the page locked, so nothing more could be edited or saved until it was reloaded.
Fixed the confirmation dialog staying on screen after the action behind it had already failed.
Fixed deleting a message that another tab had already deleted showing an error page instead of a plain notice.
Fixed the Add Device dialog leaving an earlier QR code on screen when a new one was drawn.
Fixed a checkout that cannot be priced telling the buyer "Invalid Request!" instead of explaining that the store could not convert the currency.
Fixed the add-user form accepting an invalid credit amount that the edit form already rejected.
Fixed the date-range picker showing its two dates the wrong way round in right-to-left languages.
Improved dark mode across the dashboard. The overview chart no longer appears as a solid white block, and loading spinners, dropdown menus, notification popups, number and date controls, file pickers, the code editor and keyboard focus outlines are all readable on dark backgrounds.
Improved text contrast on the dashboard, the public site and the offline documentation, so stat labels, placeholder text, secondary headings and links meet accessibility standards in both themes.
Improved keyboard access and visible focus, including the flow builder's controls, primary buttons, and the action buttons on a selected table row.
Added a hint inside every gateway and shortener credential box showing what belongs there, and the provider list now opens with a provider already chosen instead of an empty selection.
Added a badge on bulk actions showing how many rows the action will apply to.
Added an underline to links written inside explanatory text, so they can be told apart from the words around them.
Fixed device pairing QR codes that could not be scanned at all. On many sites the Add Device code was refused by the gateway app however it was scanned, so pairing a phone was impossible. Upload the Android gateway app from this release as well, so phones already in use get the matching scanner fix.
Fixed the Add Device dialog showing two QR codes at once, where the app read the app-download code instead of the pairing code and reported that it was not a pairing code. The download code now sits behind a "Show QR" link.
Fixed the Android gateway app giving up after reading the wrong QR code, instead of carrying on scanning until it finds a pairing code.
Fixed the Android gateway app failing to scan on phones whose camera pads its image rows, where nothing would decode at all.
Fixed AI replies failing silently on OpenAI's gpt-5 and o-series models, including the model new keys use by default. A key created with the out-of-the-box settings never produced a reply, and the only trace was a line in the error log.
Fixed new Google Gemini keys defaulting to a model Google no longer serves to new accounts, which left AI replies not working at all.
Added the current Gemini models — 3.7 Flash, 3.6 Flash, 3.5 Flash, 3.5 Flash-Lite and 3.1 Flash-Lite — to the AI key screens. The 2.5 models remain selectable, and continue to work for Google projects that already use them.
Fixed the WhatsApp server running out of file handles over time, which eventually left it unable to open any session or connection until it was restarted.
Fixed the WhatsApp server deleting a linked session's data in rare cases, which unlinked the device and required scanning a fresh QR code to restore it.
Fixed re-linking a WhatsApp device failing when a previous session for the same device was still being removed.
Improved the WhatsApp server's error reporting, so a request that can never succeed is no longer retried as though it were a temporary outage.
Fixed QR codes for sites with non-English web addresses carrying an invisible extra character.
This release adds new text. If you already have a language installed, your own
copy is never overwritten by an update, so the new phrases will show as raw keys
until you refresh it.
Customised a language? Do not overwrite it. That repository's "changes" folder
lists exactly the keys each version adds — take the file for this version and add
just those lines to your own translation.
Changelog v3.11.1
Fixed SMS gateways and URL shorteners being left unusable after updating to 3.11.0. This update restores them automatically, together with the credentials you had saved, and leaves any provider you already repaired yourself untouched. One limit worth knowing: providers you host on your own domain — YOURLS, PHPShort, 66Biolinks, BeLink, Premium URL Shortener and Tiara — cannot be identified automatically and are not restored. Re-add those under Administration and enter their details again, along with anything else still missing after the update.
Fixed long incoming text messages arriving as several separate, cut-off records instead of one message, which split words and web links partway through. Install the Android gateway app included with this release to get the fix.
Fixed a lost piece of a multi-part text message being discarded without trace, which could leave a message looking complete while a section in the middle had gone. The gap is now shown in place as "[missing segment]".
Added Arabic, Japanese and Chinese to the Android gateway app's SMS settings and to the screen that explains how to restore SMS permissions, both of which appeared only in English in the last release.
Added a check that stops installation on a server missing the PHP extensions Zender needs (bcmath or gmp). Without one of them, adding a device, signing the gateway app in, and password-reset and confirmation emails all fail while showing only a generic error. The requirement is now listed in the documentation, has its own troubleshooting entry, and is named in the log.
Added translations for the ChatGPT Bridge plugin in all 31 languages. These take effect when the plugin's next version is released.
Updated the WhatsApp server to the latest version of the library that tracks WhatsApp's protocol. Replace your server binary with the one in this release to keep linking and sending reliable.
Improved the response time of the endpoints your paired phones call on every request.
This release adds new text. If you already have a language installed, your own
copy is never overwritten by an update, so the new phrases will show as raw keys
until you refresh it.
Customised a language? Do not overwrite it. That repository's "changes" folder
lists exactly the keys each version adds — take the file for this version and add
just those lines to your own translation.
Changelog v3.11.0
Fixed package and credit purchases failing on every payment method, including bank transfer. Currency conversion has been broken since 3.10.0, so checkout could never complete. Add your Exchange Rate API key under Admin → Overview → System; a site already priced in USD does not need one.
Updated OTP verification to require the phone number being checked, not just the code. Any integration that calls it must now send the number as well. This closes a flaw that let someone verify a number they did not control.
Updated the Admin API to refuse an empty token, and to create one for you when you switch the feature on. An install with the Admin API enabled but no token generated was open to anyone who found it, so check yours.
Updated deleting a WhatsApp account through the API to require the delete permission, which was documented but never enforced. A key you scoped without delete rights could still delete accounts; if any integration relied on that, grant the permission properly.
Fixed package sending limits never being applied, so every account could send without limit whatever its package allowed. Limits now work as intended — review your packages before you update if you rely on them.
Fixed the connection to your WhatsApp server failing whenever its secret contained a "#". A secret containing a "/" is now refused when you save it, so choose a different one if yours has it.
Fixed Android pairing codes expiring before they appeared on screen, which made pairing impossible across the Americas and left the code valid far too long further east.
New provider system for SMS gateways and link shorteners. Pick from 17 providers included with Zender, or paste a provider file for anything else. Check your gateways and shorteners after updating: recognised providers are converted for you along with whatever credentials could be read from the old file, but anything self-hosted — such as YOURLS, Tiara, PHPShort or 66biolinks — has to be added again by hand, and a provider left short of a credential will refuse to send until you complete it.
Removed the option to upload a PHP file for a gateway or shortener. Uploading code onto your own site was a security risk, and providers are ordinary configuration now.
Fixed senders being charged more than once for the same message when a provider repeated a delivery report, or when a phone repeated a send report. Partner commissions were duplicated the same way, overstating what a partner was owed.
Fixed edits silently failing to save on contact groups, API keys and orders, where the change appeared to fail for no stated reason.
Fixed a deleted gateway stopping every scheduled message from being sent.
Fixed scheduled WhatsApp messages being able to halt the whole scheduled run.
Fixed AI flow auto-replies never being sent over SMS.
Fixed a gateway saved without a default price emptying the gateway list, which left no way to edit or repair it from the dashboard.
Fixed several lists showing nothing at all when one row referred to something since deleted — scheduled messages, marketing, and partner rates were all affected.
Fixed the Flow Builder returning an error page instead of a proper response when a step was saved without a name.
Fixed an unrecognised payout reference showing a server error page.
Added a check that rejects deletion requests arriving from another site, so a crafted link an administrator clicks can no longer remove data.
Improved sign-in security: session cookies are now protected from scripts and cross-site use, sessions are renewed whenever you sign in or out, and a session the server never issued is rejected.
Improved the strength of generated API keys, webhook secrets and security tokens.
Fixed uploaded files being able to run as code when an extension was hidden in the middle of the filename.
Fixed imported contact names being able to inject content into your dashboard.
Fixed error pages revealing where Zender is installed on your server, and added protection against your dashboard being framed by another site.
Fixed plugin details never actually being checked before installing, so an invalid plugin was accepted as valid.
Updated a bundled component to close a published security advisory.
Fixed the installer showing the administrator password in plain text as you typed it.
Improved accessibility throughout the dashboard: form labels are now linked to their fields, buttons and icons have names screen readers can read, keyboard focus is visible and stays inside open dialogs, and notifications are announced.
Fixed the error page's "Reload" link signing you out instead of reloading.
Fixed several API problems: retrieving an SMS message was impossible because of a permission that could not be granted, deleting an SMS campaign looked up the wrong value, and sending a one-time password rejected the capitalised "SMS" and "WhatsApp" the reference itself showed.
Updated the API reference to drop endpoints, fields and permissions that no longer exist, and the offline copy now says plainly that it covers common tasks rather than the whole API, pointing to the full reference in your dashboard.
Improved the Android gateway app: when SMS permissions are refused it now explains what is missing and how to enable it, including the extra step Android requires for side-loaded apps, instead of closing itself.
Improved the Android gateway app's device information dialog, which now shows the SMS settings it was already collecting.
Updated the WhatsApp server to the latest library, and tightened the sender checks at both ends so a slightly malformed sender is no longer accepted by one side and silently dropped by the other.
Fixed problems being silently discarded rather than recorded, so database and provider failures now appear in your error log.
Updated the WhatsApp server. Replace your titansys-whatsapp binary with the one in this release's WhatsApp folder, or the two WhatsApp fixes below will not take effect.
Changed the WhatsApp server so it no longer marks incoming messages as read by default. Linking an account used to mark every incoming message as read immediately, which silently stopped notifications from appearing on that phone. If you do want messages marked as read automatically, start the server with --autoread.
Fixed the system updater reporting a successful update when it had actually copied nothing. It now checks that every file it needs to replace can be written before it starts, stops if a file fails to copy instead of carrying on, and records the new version only once everything else is in place.
Fixed a failed database step during an update being ignored. The update now stops and reports the problem rather than continuing on and deleting files.
Improved the message shown when a WhatsApp QR code cannot be generated. Instead of one generic error you are now told the actual reason: an outdated server binary, linked devices turned off on the phone, a session already linked elsewhere, or a QR code that expired before it was scanned.
Fixed step 4 of the Setup WhatsApp Server window linking to a documentation page that could never open. It now names the file to read in your release ZIP.
Fixed the menu links on the public About, Privacy and Terms pages doing nothing when clicked. They now take you to the matching section of the landing page.
Fixed a flaw in how web addresses were matched to pages: a crafted address could reach files elsewhere on the server that were never meant to be web-accessible, and on some server setups could be taken further than that. Addresses are now matched only against the platform's own pages, and anything unrecognised falls back to the home page — updating is recommended for every install
Fixed the bundled Android gateway app being rejected when you tried to upload it: the file shipped in 3.10.0 did not carry its version in the filename, which the Gateway card requires, so the app you were sent could not be installed from your own dashboard
Updated the WhatsApp server to the latest messaging library, so device linking and message delivery keep working as WhatsApp changes
Updated the bundled Android gateway app to 3.10.1, matching the platform version
Updated the offline documentation with a "Keeping it running" section for the WhatsApp server, covering how to keep it alive after a restart; guidance that did not apply to this product has been removed, and the troubleshooting page now matches
Improved the Updates folder in this download, which now carries the previous release's update package alongside this one, so an install still on 3.9.8-fix-102525 can be brought fully up to date from this single download
Update package for existing installations is under "Updates/v3.10.0 to v3.10.1/"
This release adds new text. If you already have a language installed, your own
copy is never overwritten by an update, so the new phrases will show as raw keys
until you refresh it.
Customised a language? Do not overwrite it. That repository's "changes" folder
lists exactly the keys each version adds — take the file for this version and add
just those lines to your own translation.
Changelog v3.10.0
Before you update
Updated the minimum PHP version to 8.4.1. Check your server before updating — on anything older, every page will return an error, including the dashboard
Added a required Exchange Rate API key for anyone using USD Conversion on a payment gateway. Without it checkout is now refused rather than charging the wrong amount; set it under Admin → Overview → System
Updated the WhatsApp server to require a secret you choose yourself. It ships with a blank one and refuses to start until you set it, replacing the shared default that earlier versions used
Removed the Titan Echo cron job; delete that line from your crontab
Renamed the Payments folder in the download to Plugins
New
New in-house AI: conversations now go straight from your site to OpenAI, Anthropic, Gemini, DeepSeek or Grok using your own key, instead of passing through our servers. Chat history is stored in your own database, and failures are logged instead of silently returning nothing
New realtime notifications powered by Pusher, or any compatible server you host yourself. Set it up under Admin → Overview → System
New Android SMS gateway app, ready to install from Gateway/prebuilt/ and with full source under Gateway/src/. Devices now pair by scanning a QR code that expires after ten minutes and works only once
New complete offline documentation in Documentation/, replacing the link to an online help centre
Added full Go source for the WhatsApp server under WhatsApp/src/, with binaries pre-built for Linux x86-64, Linux ARM64 and macOS (Apple Silicon) in WhatsApp/prebuilt/. Windows is not pre-built; build it from source
Improved the built-in API reference so it works offline and on any install, instead of failing when it could not reach our licence server
Security
Fixed a flaw that let a crafted file upload run code on your server
Fixed a flaw that could expose your database credentials over the web
Fixed a flaw that let a crafted plugin archive write or delete files outside its own folder
Removed a third-party script that every dashboard page loaded from an outside server, replacing it with a copy served from your own site
Updated bundled libraries to clear 18 published security advisories
Fixed payment handling so a repeated notification from a provider can no longer credit the same order twice, and so the amount paid is checked against the amount owed before anything is credited (PayPal and Mollie)
Fixed
Fixed missing translations showing as raw keys such as and_dash_pg_pay_line45; anything not yet translated now falls back to English
Fixed checkout selling a package for nothing when a currency conversion failed
Fixed campaigns ignoring your unsubscribe list for manually typed numbers
Fixed flows bound to one device firing for every device
Fixed typed video, audio and document links being discarded in the flow builder
Fixed a paused flow never resuming, which left that contact permanently excluded from flows and auto-replies
Fixed WhatsApp Servers being reachable only by the main administrator, however you had set up roles
Fixed the mobile-number check, which had never actually filtered anything
Improved WhatsApp handling for the LID era; direct messages and groups are resolved to phone-number identities before reaching the platform
Update package for existing installations is under "Updates/v3.9.8-fix-102525 to v3.10.0/"