Pantheon release notes

All Pantheon-maintained Drupal modules and WordPress plugins have been confirmed compatible with PHP 8.5. Some required code updates and received new releases; others were already compatible.

Drupal modules

The following Drupal modules have been updated for PHP 8.5 compatibility:

• Pantheon Advanced Page Cache 2.4.0
• Pantheon Secrets 1.1.0
• Search API Pantheon 8.5.0
• Pantheon Content Publisher 1.0.5
• Pantheon Domain Masking 2.2.0

WordPress plugins

The following WordPress plugins have been updated for PHP 8.5 compatibility:

• Pantheon Advanced Page Cache 2.1.2
• WP Redis 1.4.7
• WP Native PHP Sessions 1.4.5
• Pantheon HUD 0.4.5
• WP SAML Auth 2.3.4
• Pantheon Content Publisher 1.3.6
• Pantheon MU Plugin 1.5.7

To switch your site to PHP 8.5, see Upgrade PHP Versions.

Pantheon has released version 2.3.4 of the WP SAML Auth WordPress plugin.

Version 2.3.3 was released on August 11, 2026 with a security fix for SAML user matching. The 2.3.3 package published to the WordPress Plugin Repository was missing its vendor directory, which includes the bundled onelogin/php-saml library, so sites that took that update could not authenticate through SAML. Version 2.3.4 was released the following day to correct the packaging, and it carries the 2.3.3 security fix as well. Both releases are one day apart, so a site may be on either version depending on when it last updated.

What's new

• Security: user matching now accent-sensitive — Fixes an account takeover where an accent-insensitive database collation could match a SAML attribute to the wrong WordPress user. User lookup is now verified with a case-insensitive, accent-sensitive comparison. Originally released in 2.3.3.
• Restores the bundled SAML library — The vendor directory, which includes onelogin/php-saml, is included in the package again. Sites affected by 2.3.3 will be able to authenticate through SAML after updating.

Who is affected

• Sites on 2.3.2 or earlier are missing the security fix and should update to 2.3.4.
• Sites on 2.3.3 installed from the WordPress Plugin Repository, using the WordPress dashboard, WP-CLI, or the direct download, have the security fix but may be unable to authenticate through SAML. Update to 2.3.4 to restore login.
• Sites that install the plugin with Composer are unaffected by the packaging issue, because onelogin/php-saml is resolved as a dependency rather than from the bundled copy. These sites should still update to 2.3.4 if they are on 2.3.2 or earlier.

Update to 2.3.4 from the WordPress dashboard under Plugins > Installed Plugins, or download it from the WordPress Plugin Repository.

For more details, see the plugin release notes.

The latest security release for WordPress, 7.0.4, is available on Pantheon.

Action required

Because this is a security update, we recommend all users upgrade to WordPress 7.0.4 as soon as possible from your Pantheon dashboard or Terminus to access the latest features, fixes, and security enhancements. See related documentation for how to apply core updates.

Pantheon has pre-deployed platform-wide mitigations (virtual patching via our routing network) against external abuse of the vulnerability, and are actively monitoring those rules. However, customers need to update their sites as soon as possible.

Highlights

This update resolves a security vulnerability:

• An authenticated Author+ remote code execution via malicious file upload (CVE-2026-65640).

For more information on this release, please see the WordPress documentation.

You can now update the credentials for a Custom Upstream directly from the Pantheon Dashboard — no support ticket or new upstream required. Previously, changing a private repository's access token meant either creating a new Custom Upstream and switching each site over to it, or contacting Pantheon Support.

What's new

• The upstream Settings page now has a Repository credentials section that shows whether credentials are set and lets you update them — a GitHub personal access token or a Bitbucket repository access token.
• The stored credential is masked and never displayed back in the Dashboard.

Changing the repository URL still requires creating a new Custom Upstream.

For steps, see Edit an Existing Custom Upstream.

The latest security release for WordPress, 7.0.3, is available on Pantheon.

Action required

Because this is a security update, we recommend all users upgrade to WordPress 7.0.3 as soon as possible from your Pantheon dashboard or Terminus to access the latest features, fixes, and security enhancements. See related documentation for how to apply core updates.

Pantheon has pre-deployed platform-wide mitigations (virtual patching via our routing network) against external abuse of the vulnerability, and are actively monitoring those rules. However, customers need to update their sites as soon as possible.

Highlights

This update resolves a number of security vulnerabilities, including:

• A pre-authentication reflected XSS attack that can lead to remote code execution
• Several other XSS issues that require an authenticated user

The RCE vulnerability is serious, but unlike wp2shell it requires specific targeting of a user to be effective. However, it is present on all versions of WordPress going back to 4.7.

Backports

Backport patches for older branches of WordPress have been published to our WordPress upstream. Customers on an older branch should update to the patched release for their branch:

6.9.6, 6.8.7, 6.7.6, 6.6.6, 6.5.9, 6.4.9, 6.3.9, 6.2.10, 6.1.11, 6.0.13, 5.9.15, 5.8.14, 5.7.16, 5.6.18, 5.5.19, 5.4.20, 5.3.22, 5.2.25, 5.1.23, 5.0.26

For more information on this release, please see the WordPress documentation.

PHP versions 8.2.33, 8.3.33, 8.4.24, and 8.5.9 are now available on the platform. These releases address three security issues, along with bug fixes and enhancements that improve performance and stability.

The most notable of these is CVE-2026-17543, a high-severity SQL injection in PHP's PostgreSQL extension (ext-pgsql) affecting pg_insert(), pg_update(), pg_select(), and pg_delete(). It is resolved by this update. Only sites using ext-pgsql to connect to an external PostgreSQL database were affected; Pantheon's own MySQL/MariaDB databases are not.

The remaining fixes are an out-of-bounds write in BCMath's bccomp() (CVE-2026-17544, affecting PHP 8.4 and 8.5) and a crash triggered by recursive symlinks in the Phar extension (CVE-2026-7260). PHP 8.5.9 and 8.4.24 also include an updated libgd (CVE-2026-9672).

Updates will be applied automatically over the next few days, so no manual action is required.

As of today, an increasing percentage of newly created sites on Pantheon will use a filesystem backed by Cloud Storage FUSE for their uploaded files (wp-content/uploads for WordPress and sites/default/files for Drupal). This filesystem replaces the "Valhalla" system Pantheon pioneered for sharing files across horizontally scalable PHP containers.

Existing sites will migrate to this new filesystem over the remainder of 2026 starting on 09/01/26.

With this change, we can create and restore backups faster and more reliably.

Background

Both WordPress and Drupal were originally architected in the early 2000s for systems where developer-controlled application files (.php, .css, .js, etc.) and files uploaded by CMS users (images, PDFs, etc.) would live on the same server. By default, both CMSes will write uploaded files to the local file system. Those defaults break down when the application files are horizontally scaled across multiple servers or containers which need to share access to an ever-changing set of uploaded files. To solve this challenge at Pantheon's founding we created a scalable filesystem (Valhalla) that mounted across containers which allows sites to behave as though they are writing to a local disc while those files are actually shared across containers. Additionally, this approach allows for the wide variance in the amount of files uploaded to WordPress or Drupal, with some sites writing millions of files.

While Valhalla was an innovative solution at Pantheon's founding, it has since been surpassed in performance by solutions like Cloud Storage FUSE. Thanks to our partnership with Google Cloud, we can deprecate Valhalla in favor of a more robust filesystem.

Rollout Timeline

New Sites: New sites will begin to be provisioned using the new filesystem on 8/3, ramping up to 100% of new sites being provisioned using the new filesystem by 8/17. There is no additional action you need to take.

Existing Sites: Existing site migrations will begin 9/1/2026. Rollout timeline:

• Free sites: September 1, 2026
• Basic sites: October 5, 2026
• Performance sites: November 16, 2026
• Elite sites: November 30, 2026

How to determine which Filesystem your site is using

In Site details, there is a Filesystem Generation field. Sites that are on the new filesystem will have a “2” in this field.

For more information, see our documentation. Should you have any questions or concerns, please reach out to our customer support team via chat or email us at the Pantheon Helpdesk.

We are continuing to enhance the Top Traffic Patterns interface with clearer visibility into what traffic actually counts toward your bill.

You can now filter the Top Traffic Sources tables – Top Paths, Top IPs, and Top User Agents – to show only Pages Served, the subset of requests that count toward billing. This makes it easy to separate the noise of total traffic from the actual billable traffic driving your usage. A new Total Requests breakdown also shows the split between Pages Served and uncounted requests at a glance.

Note: This feature is currently available only for sites migrated to Pantheon's new Global CDN (GCDN). If you don't yet see the toggle on your dashboard, consider migrating to the new GCDN to unlock this and other upcoming traffic insight enhancements.