Pantheon release notes

Integrated Composer runs composer audit on every build to check your dependencies against known security advisories.

• Dev and Multidev: Builds always succeed, even if advisories are found.
• Test: Deploying to Test fails if the latest Dev build has open advisories you haven't explicitly acknowledged.
• Live: Not audited directly, but blocked transitively, since Live only receives code by deploying from Test.

Action required

If a deploy to Test fails because of a security advisory, update the affected package where possible. When you can't update right away, you can tell Composer to stop flagging specific advisories using the config.policy block in composer.json, while keeping a version-controlled record of what you've accepted and why.

See Handling security advisories for how the check works and how to manage your own list of exclusions.

The latest version of WordPress, 7.1, is available on Pantheon as of August 19, 2026.

Action required

Upgrade to WordPress 7.1 right from your Pantheon dashboard or Terminus to access the latest features, fixes, and security enhancements. See related documentation for how to apply core updates.

Highlights

• Collaboration with Notes — Inline notes with @mentions and rich text formatting, plus suggestion mode and emoji reactions for asynchronous feedback.
• Expanded styling controls — Style blocks across screen sizes and style interactive states without writing custom CSS.
• Media improvements — A free-form image cropper, support for more image formats, and more resilient client-side media handling.
• New blocks — A Playlist block for collections of audio files with optional waveform visualization, and a Tabs block for organizing content into clickable panels.
• Site identity in the Site Editor — Title, tagline, and site icon now live in their own labeled section.
• Accessibility — A new accessible tooltips API, more predictable screen reader behavior, and improved labeling throughout the admin.
• ...and more

For full details about WordPress 7.1, see the release notes or the WordPress 7.1 Field Guide.

As part of Pantheon's Long-Term Support (LTS) for Drupal 7, Drupal 7.106 is now available with a backported security patch.

This release backports the fix for SA-CORE-2026-010, an information disclosure vulnerability in the Image module. Image style derivatives stored on file schemes other than the core private scheme could be served without the access checks intended for access-restricted images.

Action required

Apply the latest upstream update to your Drupal 7 site to receive this fix. See related documentation for how to apply core updates.

About Drupal 7 Long-Term Support

Pantheon has partnered with Tag1 Consulting to deliver security updates and maintenance for Drupal 7 sites. This extended support is included at no additional cost.

For configuration guidance and detailed information, visit our related documentation.

Pantheon has released version 2.3.4 of the WP SAML Auth WordPress plugin.

Version 2.3.3 was released on August 11, 2026 with a security fix for SAML user matching. The 2.3.3 package published to the WordPress Plugin Repository was missing its vendor directory, which includes the bundled onelogin/php-saml library, so sites that took that update could not authenticate through SAML. Version 2.3.4 was released the following day to correct the packaging, and it carries the 2.3.3 security fix as well. Both releases are one day apart, so a site may be on either version depending on when it last updated.

What's new

• Security: user matching now accent-sensitive — Fixes an account takeover where an accent-insensitive database collation could match a SAML attribute to the wrong WordPress user. User lookup is now verified with a case-insensitive, accent-sensitive comparison. Originally released in 2.3.3.
• Restores the bundled SAML library — The vendor directory, which includes onelogin/php-saml, is included in the package again. Sites affected by 2.3.3 will be able to authenticate through SAML after updating.

Who is affected

• Sites on 2.3.2 or earlier are missing the security fix and should update to 2.3.4.
• Sites on 2.3.3 installed from the WordPress Plugin Repository, using the WordPress dashboard, WP-CLI, or the direct download, have the security fix but may be unable to authenticate through SAML. Update to 2.3.4 to restore login.
• Sites that install the plugin with Composer are unaffected by the packaging issue, because onelogin/php-saml is resolved as a dependency rather than from the bundled copy. These sites should still update to 2.3.4 if they are on 2.3.2 or earlier.

Update to 2.3.4 from the WordPress dashboard under Plugins > Installed Plugins, or download it from the WordPress Plugin Repository.

For more details, see the plugin release notes.

The latest security release for WordPress, 7.0.4, is available on Pantheon.

Action required

Because this is a security update, we recommend all users upgrade to WordPress 7.0.4 as soon as possible from your Pantheon dashboard or Terminus to access the latest features, fixes, and security enhancements. See related documentation for how to apply core updates.

Pantheon has pre-deployed platform-wide mitigations (virtual patching via our routing network) against external abuse of the vulnerability, and are actively monitoring those rules. However, customers need to update their sites as soon as possible.

Highlights

This update resolves a security vulnerability:

• An authenticated Author+ remote code execution via malicious file upload (CVE-2026-65640).

For more information on this release, please see the WordPress documentation.

The latest security release for WordPress, 7.0.3, is available on Pantheon.

Action required

Because this is a security update, we recommend all users upgrade to WordPress 7.0.3 as soon as possible from your Pantheon dashboard or Terminus to access the latest features, fixes, and security enhancements. See related documentation for how to apply core updates.

Pantheon has pre-deployed platform-wide mitigations (virtual patching via our routing network) against external abuse of the vulnerability, and are actively monitoring those rules. However, customers need to update their sites as soon as possible.

Highlights

This update resolves a number of security vulnerabilities, including:

• A pre-authentication reflected XSS attack that can lead to remote code execution
• Several other XSS issues that require an authenticated user

The RCE vulnerability is serious, but unlike wp2shell it requires specific targeting of a user to be effective. However, it is present on all versions of WordPress going back to 4.7.

Backports

Backport patches for older branches of WordPress have been published to our WordPress upstream. Customers on an older branch should update to the patched release for their branch:

6.9.6, 6.8.7, 6.7.6, 6.6.6, 6.5.9, 6.4.9, 6.3.9, 6.2.10, 6.1.11, 6.0.13, 5.9.15, 5.8.14, 5.7.16, 5.6.18, 5.5.19, 5.4.20, 5.3.22, 5.2.25, 5.1.23, 5.0.26

For more information on this release, please see the WordPress documentation.

The latest security release for WordPress, 7.0.2, is available on Pantheon as of July 17, 2026.

Action required

Because this is a security update, we recommend upgrade to WordPress 7.0.2 as soon as possible from your Pantheon dashboard or Terminus to access the latest features, fixes, and security enhancements. See related documentation for how to apply core updates.

Highlights

This update resolves two security vulnerabilities that were reported via WordPress core's HackerOne reporting portal. Fixes in this release include:

• A facilitated SQL injection issue
• A REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

WordPress 6.9 is affected by both vulnerabilities. Version 6.9.5 has been released with fixes for both and is also available from our WordPress upstream.

WordPress 6.8 is only affected by the first vulnerability. Version 6.8.6 has been released with the fix and is available from our WordPress upstream.

For more information on this release, please visit the HelpHub site.

After a successful Beta phase, Pantheon's next-generation Global CDN (GCDN) is now generally available. Built on Cloudflare, the new GCDN delivers built-in bot protection, expanded site eligibility, and the same self-serve migration experience customers have been using in the Beta — now production-ready for the majority of sites on the platform.

What's included

• Built-in bot protection — Incoming traffic is automatically scored, with managed challenges issued to suspicious requests and verified bots (such as search engine crawlers) allowed through.
• Multizone Failover support — Sites with Multizone Failover enabled can migrate to GCDN and continue to benefit from automated regional failover.
• Custom Certificates support — Sites using customer-provided TLS certificates are now supported on GCDN. Migration for these sites is owned by our Professional Services team and coordinated through support — open a support ticket to get started.
• Platform vanity domain support — Organization-owned vanity hostnames (e.g., live-mysite.example-agency.com) are fully supported. Migration for these sites is owned by our Professional Services team and coordinated through support — open a support ticket to get started.

Action Required

Eligible sites will display a GCDN banner in the Pantheon dashboard. To migrate:

1. Locate the GCDN banner on an eligible site.
2. Click it and complete the guided process.
3. Point your DNS records to the new GCDN infrastructure.

Domain verification supports DNS-01 TXT record validation, requiring TXT records added at your DNS provider.

Eligibility

GCDN is available to all sites on the platform except those currently using Advanced Global CDN (AGCDN). AGCDN customers will be migrated in a future phase — no action is required from them at this time.

More information

For full details on GCDN, refer to the Global CDN guide on the Pantheon docs site.