Pantheon release notes

Drupal core security release SA-CORE-2026-014 (CVE-2026-108097, risk 19/25) is now available. It fixes a critical remote code execution vulnerability in the Field UI module. Drupal core alone is not directly exploitable, but several exploit paths exist through contributed modules, and at least one does not require authentication. Custom code can also expose the vulnerable functionality.

Action required

Update your Drupal sites to a patched release as soon as possible.

• Drupal 11.4.10
• Drupal 11.3.19
• Drupal 10.6.19

Drupal 12.0.0-alpha1 through 12.0.0-beta1 are also affected. See the security advisory for Drupal 12 fix details.

Drupal 11.2.x and earlier, Drupal 10.5.x and earlier, Drupal 9, and Drupal 8.9 are end-of-life. They are affected and do not receive a patch. Upgrade these sites to a supported release.

Drupal 7 sites on Pantheon receive this fix through Drupal 7 long-term support. See the Drupal 7.107 release note.

To apply the update, use one-click core updates in the Pantheon dashboard.

Mitigation until you update

If you cannot update right away, uninstall the core Field UI module (field_ui). The Drupal Security Team states this protects your site until you update.

As a founding Platform Partner of the Drupal Steward program, Pantheon provides protection against some known attack vectors. Steward does not cover all possible exploits, so update your site.

As part of Pantheon's Long-Term Support (LTS) for Drupal 7, Drupal 7.107 is now available with a backported security patch.

This release backports the fix for SA-CORE-2026-014 (CVE-2026-108097), a critical remote code execution vulnerability in the Field UI module. Drupal core alone is not directly exploitable, but several exploit paths exist through contributed modules, and at least one does not require authentication.

Action required

Apply the latest upstream update to your Drupal 7 site to receive this fix. See related documentation for how to apply core updates.

This fix changes how Field UI overview tables assign rows to regions: Drupal core no longer calls the #region_callback function set on a table row. After you update, review whether any custom code uses #region_callback, and test the Manage fields and Manage display pages to confirm the Field UI tables work as expected.

About Drupal 7 long-term support

Pantheon has partnered with Tag1 Consulting to deliver security updates and maintenance for Drupal 7 sites. This extended support is included at no additional cost.

For configuration guidance and detailed information, visit our related documentation.

Pantheon has updated the default PHP version for the Drupal (Composer Managed) upstream to PHP 8.3, replacing the previous default of PHP 8.2.

New Drupal sites created from Pantheon's upstreams use PHP 8.3. Existing sites that do not set php_version in their own pantheon.yml move to PHP 8.3 when they apply this upstream update. When you apply the update, Pantheon also updates config.platform.php in your composer.json to match, if it does not already.

Sites started from the Drupal 11 start state will see this update, but should already be running PHP 8.3.

Action required

Test the update before you deploy it to the Live environment. Apply it in Dev or a Multidev environment, confirm your modules and theme work on PHP 8.3, then promote it.

If your Drupal 10 site needs to stay on PHP 8.2, pin the version by setting php_version: 8.2 in your site's pantheon.yml before you apply the update. For steps, see Manage PHP Versions.

If you maintain a custom upstream, this change is not reflected in your pantheon.upstream.yml unless you update your fork from Pantheon's upstream.

As part of Pantheon's Long-Term Support (LTS) for Drupal 7, Drupal 7.106 is now available with a backported security patch.

This release backports the fix for SA-CORE-2026-010, an information disclosure vulnerability in the Image module. Image style derivatives stored on file schemes other than the core private scheme could be served without the access checks intended for access-restricted images.

Action required

Apply the latest upstream update to your Drupal 7 site to receive this fix. See related documentation for how to apply core updates.

About Drupal 7 Long-Term Support

Pantheon has partnered with Tag1 Consulting to deliver security updates and maintenance for Drupal 7 sites. This extended support is included at no additional cost.

For configuration guidance and detailed information, visit our related documentation.

All Pantheon-maintained Drupal modules and WordPress plugins have been confirmed compatible with PHP 8.5. Some required code updates and received new releases; others were already compatible.

Drupal modules

The following Drupal modules have been updated for PHP 8.5 compatibility:

• Pantheon Advanced Page Cache 2.4.0
• Pantheon Secrets 1.1.0
• Search API Pantheon 8.5.0
• Pantheon Content Publisher 1.0.5
• Pantheon Domain Masking 2.2.0

WordPress plugins

The following WordPress plugins have been updated for PHP 8.5 compatibility:

• Pantheon Advanced Page Cache 2.1.2
• WP Redis 1.4.7
• WP Native PHP Sessions 1.4.5
• Pantheon HUD 0.4.5
• WP SAML Auth 2.3.4
• Pantheon Content Publisher 1.3.6
• Pantheon MU Plugin 1.5.7

To switch your site to PHP 8.5, see Upgrade PHP Versions.

Sites can now compile frontend assets (themes, design systems, and other Node.js-based tooling) automatically as part of the build process.

When enabled, Pantheon installs your Node.js dependencies and runs your build script for each configured path on every code push, so compiled assets no longer need to be committed to your repository. Frontend builds work on any site, whether or not you use Integrated Composer.

Enable frontend builds

Add a frontend_build block to your pantheon.yml file:

Pantheon selects a package manager automatically based on the lock file present in each build path. Supported package managers include bun, pnpm, yarn, and npm.

For full configuration details and examples, see the frontend asset builds documentation.

Pantheon Search now supports Apache Solr 9.10.1 for Drupal 7, 10, and 11 sites, with improved security defaults, the unified highlighter, and performance enhancements. See the major changes in Solr 9 for details.

How to get Solr 9

Drupal 10 and 11

Solr 9 support is available through Search API Pantheon version 8.5.0.

For detailed setup instructions, see the Solr for Drupal 10/11 guide.

Drupal 7

Solr 9 support is available through the Pantheon Drupal 7 upstream version 7.105.1.

For detailed setup instructions, see the Solr for Drupal 7 guide.

Solr 3 and Solr 8 removal timeline

The previously announced removal schedule still holds:

• Solr 3 will be removed on February 9, 2027. Drupal sites using Solr 3 must migrate to Solr 9 before this date. WordPress sites using Solr 3 through the Solr Power plugin should consider switching to Elasticsearch.
• Solr 8 will be removed on July 11, 2027. Drupal 10 and 11 sites using Solr 8 should migrate to Solr 9 before this date.

Feedback

Report issues or provide feedback in the drupal.org issue queue for Drupal 10/11, or through Pantheon Support for Drupal 7.

Drupal has released a highly critical security update (CVSS 20/25) for Drupal core addressing SA-CORE-2026-004 (CVE-2026-9082). The vulnerability is a SQL injection flaw in Drupal's database abstraction API that only affects sites running on PostgreSQL. Drupal 7 is not affected.

No action is required to protect your Pantheon-hosted sites. Pantheon does not use PostgreSQL, so this vulnerability does not apply to sites hosted on Pantheon. Additionally, as a founding Platform Partner of the Drupal Steward program, Pantheon worked with the Drupal Security Team to implement platform-level mitigations prior to public disclosure.

Recommended update

We still recommend updating to the latest Drupal core patch release to keep your codebase aligned with upstream supported branches.

Patched releases for supported branches:

• Drupal 11.3.10 and 11.2.12
• Drupal 10.6.9 and 10.5.10

Emergency patches are also available for end-of-life branches 11.1.x, 10.4.x, 9.5.x, and 8.9.x — see the security advisory for details.

To apply the update, use one-click core updates in the Pantheon dashboard.