VulCode

PHPMailer: our changes to an open source project

The classic PHP library for sending email, used by WordPress and many other systems.

All contributions
Language
PHP
GitHub stars
22,310
3merged changes
From 10 Sep 2026 to 4 Oct 2026.
Number 5 of the 64 GitHub projects with our changes, by stars. First is Zed (91,587).

The changes merged into PHPMailer

The QUIT command no longer ends up in the body of an interrupted message, long address headers are folded, and S/MIME signatures have normalised line breaks.

How we tested #3362

A new test, testQuitDuringData, opens a connection, sends MAIL and RCPT, starts DATA without sending the message, as if the send had been interrupted, and calls quit(). It then checks the client debug output to confirm that QUIT was not sent and that the connection is closed.

PHP

Our projects in this technology, their screens and when we choose it.

The bug, the fix and the lesson

A summary of our Tech news write-up: what was broken, what we changed and what it means for our own work.

What was broken

QUIT became a line of the message

When sending broke off after DATA and the application closed the connection with quit(), the server took QUIT as part of the email and never replied. The client waited until the time limit ran out.

What we changed

quit() checks the connection state

The SMTP class remembers the last command it sent, and in the DATA state quit() just closes the connection without sending QUIT.

if ($this->state === 'DATA') {
//The server would take QUIT as part of an unfinished message, so just close the connection
$noerror = true;
} else {
$noerror = $this->sendCommand('QUIT', 'QUIT', 221);
}
What it taught us

SMTP has states, and a command sent in the wrong one becomes part of the message.

When sending mail we always check the connection's state before closing it.

Other projects with our changes: PHP

20 projects in this technology have our merged changes. The bar is the repository's stars, next to it the number of our changes. Each row leads to the project's page.

PHP
The other 12 on the list of all contributions

Questions about our changes to PHPMailer

Where these changes come from, who merged them and whether we can fix something in your library.

Using PHPMailer in your project?

If something in it does not work, we fix it at the source and leave a workaround until the release. We reply within an hour.