Pantheon release notes

The latest version of WordPress, 7.1, is available on Pantheon as of August 19, 2026.

Action required

Upgrade to WordPress 7.1 right from your Pantheon dashboard or Terminus to access the latest features, fixes, and security enhancements. See related documentation for how to apply core updates.

Highlights

• Collaboration with Notes — Inline notes with @mentions and rich text formatting, plus suggestion mode and emoji reactions for asynchronous feedback.
• Expanded styling controls — Style blocks across screen sizes and style interactive states without writing custom CSS.
• Media improvements — A free-form image cropper, support for more image formats, and more resilient client-side media handling.
• New blocks — A Playlist block for collections of audio files with optional waveform visualization, and a Tabs block for organizing content into clickable panels.
• Site identity in the Site Editor — Title, tagline, and site icon now live in their own labeled section.
• Accessibility — A new accessible tooltips API, more predictable screen reader behavior, and improved labeling throughout the admin.
• ...and more

For full details about WordPress 7.1, see the release notes or the WordPress 7.1 Field Guide.

As part of Pantheon's Long-Term Support (LTS) for Drupal 7, Drupal 7.106 is now available with a backported security patch.

This release backports the fix for SA-CORE-2026-010, an information disclosure vulnerability in the Image module. Image style derivatives stored on file schemes other than the core private scheme could be served without the access checks intended for access-restricted images.

Action required

Apply the latest upstream update to your Drupal 7 site to receive this fix. See related documentation for how to apply core updates.

About Drupal 7 Long-Term Support

Pantheon has partnered with Tag1 Consulting to deliver security updates and maintenance for Drupal 7 sites. This extended support is included at no additional cost.

For configuration guidance and detailed information, visit our related documentation.

Pantheon MU-Plugin 1.5.7 adds dismiss and hide controls for the Pantheon WordPress core update notice ("A new WordPress update is available!"). Apply upstream updates to get this version of the mu-plugin.

Dismiss the notice

Any user who sees the notice can dismiss it with the X in the corner. The dismissal is saved per user, so it persists across page loads and logins. The notice reappears only when a newer WordPress version becomes available.

Hide the notice

To hide the notice more permanently, or for everyone, you can:

• Target #pantheon-update-notice (or the .pantheon-update-notice class) with CSS.
• Return false from the pantheon_show_update_notice filter.
• Define the PANTHEON_SHOW_UPDATE_NOTICE constant as false in wp-config.php.

For details, see Suppress WordPress Admin Notice.

Pantheon has extended traffic visibility on the dashboard – you can now see aggregated traffic insights across your entire workspace, giving portfolio managers and agencies a single view of what's happening across all their sites.

• Workspace Top IPs, User Agents, and Visited Paths: New tabs on the workspace Insights page show the top IP addresses, user agents, and visited paths generating traffic across every site in your workspace – no need to check each site individually to spot patterns.
• Drill-Down by Site: Click into any row to see which specific sites are driving that traffic, so you can quickly pinpoint where to focus your attention.
• User Agent Parsing: Instantly see a parsed breakdown of any user agent to help you confirm whether high-volume traffic is a real visitor or something worth investigating further.
• IP Investigation: Click any IP address to open its AbuseIPDB report so you can quickly assess whether it has a history of malicious activity.

For more details, see related documentation.

What's new

You can now choose how the Pantheon Dashboard looks. Alongside the classic Light appearance, the Dashboard supports a full Dark mode, plus a System option that automatically follows your device or browser's own light/dark setting.

Pick your preference from the Theme control in your User Menu:

• Light — the classic Dashboard appearance (default)
• Dark — a full dark color scheme across the Dashboard
• System — automatically matches your OS or browser's current preference, and updates live if that setting changes

Your choice is saved to your account, so it follows you across devices and browsers — no need to set it again each time you log in somewhere new. If you haven't set a preference, the Dashboard defaults to Light.

Why it matters

Dark mode reduces eye strain in low-light environments, can save battery on some devices, and matches how many people prefer to work. If that preference is already set at the OS level, System mode picks it up automatically — no extra effort required.

Where to find it

Look for the Theme option in your User Menu at the top of the Dashboard. For more details, see related documentation.

All Pantheon-maintained Drupal modules and WordPress plugins have been confirmed compatible with PHP 8.5. Some required code updates and received new releases; others were already compatible.

Drupal modules

The following Drupal modules have been updated for PHP 8.5 compatibility:

• Pantheon Advanced Page Cache 2.4.0
• Pantheon Secrets 1.1.0
• Search API Pantheon 8.5.0
• Pantheon Content Publisher 1.0.5
• Pantheon Domain Masking 2.2.0

WordPress plugins

The following WordPress plugins have been updated for PHP 8.5 compatibility:

• Pantheon Advanced Page Cache 2.1.2
• WP Redis 1.4.7
• WP Native PHP Sessions 1.4.5
• Pantheon HUD 0.4.5
• WP SAML Auth 2.3.4
• Pantheon Content Publisher 1.3.6
• Pantheon MU Plugin 1.5.7

To switch your site to PHP 8.5, see Upgrade PHP Versions.

Pantheon has released version 2.3.4 of the WP SAML Auth WordPress plugin.

Version 2.3.3 was released on August 11, 2026 with a security fix for SAML user matching. The 2.3.3 package published to the WordPress Plugin Repository was missing its vendor directory, which includes the bundled onelogin/php-saml library, so sites that took that update could not authenticate through SAML. Version 2.3.4 was released the following day to correct the packaging, and it carries the 2.3.3 security fix as well. Both releases are one day apart, so a site may be on either version depending on when it last updated.

What's new

• Security: user matching now accent-sensitive — Fixes an account takeover where an accent-insensitive database collation could match a SAML attribute to the wrong WordPress user. User lookup is now verified with a case-insensitive, accent-sensitive comparison. Originally released in 2.3.3.
• Restores the bundled SAML library — The vendor directory, which includes onelogin/php-saml, is included in the package again. Sites affected by 2.3.3 will be able to authenticate through SAML after updating.

Who is affected

• Sites on 2.3.2 or earlier are missing the security fix and should update to 2.3.4.
• Sites on 2.3.3 installed from the WordPress Plugin Repository, using the WordPress dashboard, WP-CLI, or the direct download, have the security fix but may be unable to authenticate through SAML. Update to 2.3.4 to restore login.
• Sites that install the plugin with Composer are unaffected by the packaging issue, because onelogin/php-saml is resolved as a dependency rather than from the bundled copy. These sites should still update to 2.3.4 if they are on 2.3.2 or earlier.

Update to 2.3.4 from the WordPress dashboard under Plugins > Installed Plugins, or download it from the WordPress Plugin Repository.

For more details, see the plugin release notes.

The latest security release for WordPress, 7.0.4, is available on Pantheon.

Action required

Because this is a security update, we recommend all users upgrade to WordPress 7.0.4 as soon as possible from your Pantheon dashboard or Terminus to access the latest features, fixes, and security enhancements. See related documentation for how to apply core updates.

Pantheon has pre-deployed platform-wide mitigations (virtual patching via our routing network) against external abuse of the vulnerability, and are actively monitoring those rules. However, customers need to update their sites as soon as possible.

Highlights

This update resolves a security vulnerability:

• An authenticated Author+ remote code execution via malicious file upload (CVE-2026-65640).

For more information on this release, please see the WordPress documentation.