RapidWeaver Classic 10 Beta 3 Now Available (Security Update)

[dan]

Hey Weavers,

We’re back with another update for RapidWeaver Classic, and this update upgrades the PHP server built into Classic (more on that below), and improves the output of the Classic Blog RSS/Podcast feeds.

If you’re license has expired, you can purchase another year of updates over on the Realmac web store.

An important security update for RapidWeaver Classic

We’ve updated the PHP bundled with RapidWeaver Classic to version 8.4.27 following the disclosure of two critical security vulnerabilities in PHP.

Classic uses its bundled PHP to preview websites on your Mac, including pages that use contact forms and other PHP features. This update brings those previews onto the patched version.

What do you need to do?

Install the Classic update containing PHP 8.4.27. You don’t need to install PHP separately or republish your website for this fix.

What about your published website?

Your hosting server runs its own copy of PHP, which needs updating separately. If your website uses PHP for contact forms, a CMS, or third-party add-ons ask your hosting provider to confirm they’ve applied the fixes for CVE-2026-109618 and CVE-2026-109619.

No action is required from Realmac/Elements Hosting customers. All necessary updates have been handled automatically as part of our managed hosting service. Read the full announcement.

Updating Classic protects its bundled preview runtime; your hosting provider’s update addresses PHP on your live website.

What’s New in Beta 3 (Build 21202)?

• Updated the bundled PHP 8 runtime to 8.4.27.
• Fixed Classic Blog RSS to meet W3C validation and prevent podcast publishing crashes.

RapidWeaver Classic 10 Updates so far…

• Classic now requires macOS 12 or later.
• Updated settings, preferences, and built-in plugins for current macOS versions, including macOS 27.
• Added an optional upload speed limit shared across all active remote publishing connections.
• Publishing connection tests now show DNS lookup and TCP connection times.
• Explicit FTPS is now labelled FTPES.
• Amazon S3 publishing now automatically uses the selected bucket’s region.
• Fixed a crash when multiple FTP connections were active.
• Preview export errors now appear on the affected document, avoiding a potential crash.
• Fixed a crash when dragging items in the project outline.
• Fixed a crash when clicking a site resource on macOS 27.
• Fixed a crash caused by folders inside Site Resources when activating a site.
• Clicking Cancel or pressing Escape when removing blog entries no longer deletes them.
• Added authenticated SMTP support to Contact Forms, including Elements Hosting. PHP mail() remains the default.
• Added built-in honeypot spam protection to Contact Forms.
• Fixed MIME formatting in Contact Form emails sent using PHP 8 mail().
• Clearing the SMTP port field no longer causes a crash. Empty ports default to 587.
• SMTP passwords remain saved in the original document but are omitted when a page is copied or duplicated.
• Photo Album thumbnails remain visible when an image cannot be read.
• Clearing numeric settings in Photo Album no longer causes a crash.
• Blog RSS feeds now satisfy W3C validation checks
• Plugin inspector tabs now appear correctly on macOS 13
• Fixed a photo album crash caused by clearing numeric fields
• Continued work on improving the codebase and fixes minor issues

Pricing and Beta Availability

This is a free update for everyone with an active Classic licence. To get beta access, open the Preferences window, go to the Updates tab and enable the “Check for Beta updates” option.

Ongoing Support for Classic

We know many of you have built your workflow around RapidWeaver Classic, and we want to reassure you: Classic isn’t going anywhere. We’re continuing to maintain and update it with important improvements, fixes, and optimisations to keep things running smoothly.

If you’re license has expired, you can purchase another year of updates over on the Realmac web store.

Give us your Feedback

As this is a beta please let us know if you run into any issues, or if there are any other long-standing issues you’d like to see fixed and we’ll do out best to get them into the next beta.

Happy Weaving!

[ricinport (Ric)]

It was actually on my agenda today to look at purchasing another year of Classic but TBH I was put off by some of the bugs I now see users experienced in the last update, in particular the Stacks edit and confirm buttons not working!

I think there’s going to be better unification between Realmac and YourHead for this resurgence in Classic to have legs.

In particular I wanted to try an update to see if I could regain the loss of my Contact Stack (Doobox) functionality having yesterday upgraded php from an ancient 5.3 to 8.4 at server level.

With 5.3 the Contact stack has been working fine for years. 8.4 put a stop to that.

Will this Classic update improve a contact stacks functionality or is it limited to the inbuilt RW contact page?

Frankly I’ll use a contact form alternative like Letterbird for now rather than risk subjecting my business-critical websites to the vagaries of RapidWeaver beta updates.

[TomTomTech (Thomas)]

Hi all,

Thanks for the quick PHP 8.4.27 security update for Classic. While checking my own setup, I noticed something about Elements’ preview that I think is worth raising.

When I preview a site in Elements on macOS, the bundled PHP starts with php-8 -S 0.0.0.0:<port>, and Elements itself also listens on all interfaces. That means while a preview is running, the server can be reached from other devices on the local network, not just from my Mac.

Since the preview server is only for local previews, would it be possible to bind it to 127.0.0.1 (localhost) by default, with an option for anyone who really needs LAN previews, for example to test on a phone? With the recent PHP vulnerabilities, keeping it local-only seems like a simple, safe default.

Could you also confirm whether Elements’ bundled PHP has been updated to 8.4.27 like Classic’s?

For now I’m quitting Elements after previewing and blocking incoming connections to it with my firewall.

Thanks for all the work on both apps.

Tommy

[differentdan (Daniel)]

Hi @ricinport

Regarding the Contact stack, you might want to reach out to @Doobox to see if it’s compatible with newer PHP versions.

@ricinport

Will this Classic update improve a contact stacks functionality or is it limited to the inbuilt RW contact page?

No, the update wouldn’t affect that Contact stack you are mentioning as that’s a third-party addon.

@ricinport

Frankly I’ll use a contact form alternative like Letterbird for now rather than risk subjecting my business-critical websites to the vagaries of RapidWeaver beta updates.

You can use the built-in Contact Form page now as we’ve included SMTP authentication as a mail sending option (which is honestly better than the older PHP mail() function). I think your Contact stack might use that PHP function but I’m not sure on that, @Doobox would have to confirm.

In the meantime, Letterbird is a good alternative if you don’t want to use the built-in Contact Form page, and your Contact stack is not working on newer PHP versions.

[Silbersurfer (Frank Landschoof)]

Thanks, the iTunes error in the feed has been resolved.
However, there is still an issue in the feed for podcasters: the inclusion of a <dc:date> tag, which unfortunately cannot be disabled. For podcast feeds, <pubDate> is the industry standard— it is the tag required by Apple Podcasts, Spotify, and others (and can be configured via the “Custom RSS tag” option). This creates a conflict in the validator, as the rule states that “an item should not include both pubDate and dc:date.” RSS parsers are not designed to process both tags simultaneously; to avoid such conflicts, the feed specification prohibits the use of both tags within the same item.

[dan]

@TomTomTech

Could you also confirm whether Elements’ bundled PHP has been updated to 8.4.27 like Classic’s?

Elements has just been updated with PHP 8.4.27 you can read the full release notes here.

[gnosismedia]

How do users not on 10 beta install the PHP update?

[dan]

The PHP security update is currently available as part of the Classic 10 beta.

If you’d like to install it now, open RapidWeaver Classic → Settings → Updates and enable Check for Beta Updates.

We’ll also be including the updated PHP runtime in the next stable release of Classic, so if you’d prefer not to run beta software, you can wait for that.

Just to clarify, this update only affects the PHP runtime used for local previews. Your live website uses the PHP version provided by your hosting company, which needs to be updated separately.

[PLM (Per Martins)]

I’m still using RWC 9.6.8 (21159). Can I use PHP 8.5, Apache 2.4 or should I stay with PHP 8.4, Apache 2.4 on my server? I will wait for final release of RWC (don’t trust Stacks 5).

[differentdan (Daniel)]

Hey @PLM

Changing the PHP version on your server should be non-destructive, meaning that if you change to PHP version 8.5 and something stops working on your site (like a third-party plugin/addon/stack), then you can easily just change the PHP version back to 8.4 again and things would start working as they did before.

[macgizmoguy]

YAAAAAAY!!! Happy RSS .XML output reported in the v10.0.0 (21202) beta.

The W3C has a reputation of being meaner and stricter than a Catholic School Nun when it comes to approving any kind of web code output. So thanks to the team for your recent RSS tweaks!

[dan]

Woohoo, this is awesome news. Glad we finally nailed it

[macgizmoguy]

I’m no developer - but it occurred to me - This must be a great era for programmers. You can paste a code block that’s problematic and just let Claude or ChatGPT take a hard look at it and simply ask “What are we missing here?” - And suddenly one little long-standing problem might get pin-pointed.

P.S. Also appreciate the Single-Slash https:/ Twitter Card-Open Graph fix!