Pantheon release notes

PHP versions 8.2.33, 8.3.33, 8.4.24, and 8.5.9 are now available on the platform. These releases address three security issues, along with bug fixes and enhancements that improve performance and stability.

The most notable of these is CVE-2026-17543, a high-severity SQL injection in PHP's PostgreSQL extension (ext-pgsql) affecting pg_insert(), pg_update(), pg_select(), and pg_delete(). It is resolved by this update. Only sites using ext-pgsql to connect to an external PostgreSQL database were affected; Pantheon's own MySQL/MariaDB databases are not.

The remaining fixes are an out-of-bounds write in BCMath's bccomp() (CVE-2026-17544, affecting PHP 8.4 and 8.5) and a crash triggered by recursive symlinks in the Phar extension (CVE-2026-7260). PHP 8.5.9 and 8.4.24 also include an updated libgd (CVE-2026-9672).

Updates will be applied automatically over the next few days, so no manual action is required.

As of today, an increasing percentage of newly created sites on Pantheon will use a filesystem backed by Cloud Storage FUSE for their uploaded files (wp-content/uploads for WordPress and sites/default/files for Drupal). This filesystem replaces the "Valhalla" system Pantheon pioneered for sharing files across horizontally scalable PHP containers.

Existing sites will migrate to this new filesystem over the remainder of 2026 starting on 09/01/26.

With this change, we can create and restore backups faster and more reliably.

Background

Both WordPress and Drupal were originally architected in the early 2000s for systems where developer-controlled application files (.php, .css, .js, etc.) and files uploaded by CMS users (images, PDFs, etc.) would live on the same server. By default, both CMSes will write uploaded files to the local file system. Those defaults break down when the application files are horizontally scaled across multiple servers or containers which need to share access to an ever-changing set of uploaded files. To solve this challenge at Pantheon's founding we created a scalable filesystem (Valhalla) that mounted across containers which allows sites to behave as though they are writing to a local disc while those files are actually shared across containers. Additionally, this approach allows for the wide variance in the amount of files uploaded to WordPress or Drupal, with some sites writing millions of files.

While Valhalla was an innovative solution at Pantheon's founding, it has since been surpassed in performance by solutions like Cloud Storage FUSE. Thanks to our partnership with Google Cloud, we can deprecate Valhalla in favor of a more robust filesystem.

Rollout Timeline

New Sites: New sites will begin to be provisioned using the new filesystem on 8/3, ramping up to 100% of new sites being provisioned using the new filesystem by 8/17. There is no additional action you need to take.

Existing Sites: Existing site migrations will begin 9/1/2026. Rollout timeline:

• Free sites: September 1, 2026
• Basic sites: October 5, 2026
• Performance sites: November 16, 2026
• Elite sites: November 30, 2026

How to determine which Filesystem your site is using

In Site details, there is a Filesystem Generation field. Sites that are on the new filesystem will have a “2” in this field.

For more information, see our documentation. Should you have any questions or concerns, please reach out to our customer support team via chat or email us at the Pantheon Helpdesk.

PHP versions 8.2.32, 8.3.32, 8.4.23, and 8.5.8 are now available on the platform. These updates include important security fixes, along with bug fixes and enhancements that improve performance and stability. Updates will be applied automatically over the next few days, so no manual action is required.

PHP versions 8.4.22 and 8.5.7 are now available on the platform. PHP 8.5.7 includes security fixes (CVE-2026-44927, CVE-2026-44928) along with bug fixes. PHP 8.4.22 is a maintenance release with bug fixes and stability improvements. Updates will be applied automatically over the next few days, so no manual action is required.

Setting tika_version: 1 in pantheon.yml is now rejected at validation time. Sites with this setting will receive a validation error on their next commit:

Tika 1.18 and 1.21 were removed from the platform on April 28, 2026. Since that date, tika_version: 1 was silently ignored and sites automatically used Tika 3. This change formalizes the rejection so that sites receive a clear error instead of a silent fallback.

Action Required

Update your pantheon.yml to use a supported value:

Or remove the tika_version setting entirely if your site does not use Tika. To explicitly disable Tika, set tika_version: none.

For Tika 3 configuration details, including how to disable OCR, see External Libraries: Apache Tika.

Today Pantheon announces a removal schedule for Solr 3 on February 9, 2027 and Solr 8 on July 11, 2027. Solr 9 will reach General Availability on June 30, 2026 ahead of these removals.

After a Solr version is removed from the platform, sites using that version will no longer be able to index content or return search results. Views, blocks, or other components that rely on Solr-powered search indexes may return no results or throw errors.

Solr 9 - General Availability: June 30, 2026

Solr 9 has been available as a Beta for Drupal 10 and 11 sites through search_api_pantheon version 8.5.0-beta1. Solr 9 Beta for Drupal 7 is now available as of May 12, 2026.

General Availability for Solr 9 is targeted for June 30, 2026.

Solr 3 - Removal: February 9, 2027

Solr 3 will be removed from the Pantheon platform on February 9, 2027. Solr 3 is a legacy search version that no longer receives security updates.

Previous milestones:

• Solr 3 support for Drupal 9.4+ ended December 9, 2025
• WordPress Solr support ends January 11, 2027

Drupal 7 sites still using Solr 3 must migrate to Solr 9 before this date. See the Solr for Drupal 7 guide for upgrade steps. WordPress sites should migrate to Elasticsearch or another supported search solution before January 11, 2027.

Solr 8 - Removal: July 11, 2027

Solr 8 (8.11.4) will be removed from the platform on July 11, 2027. Solr 9 supersedes Solr 8 with improved security defaults and other enhancements. Drupal 10 and 11 sites currently running Solr 8 should migrate to Solr 9 before this date. Upgrade instructions are available in the Solr 9 Beta announcement.

Action required

• Drupal:

  • Solr 3 sites: Migrate to Solr 9 before February 9, 2027.
  • Solr 8 sites: Migrate to Solr 9 before July 11, 2027.

  For guidance on upgrading, see Drupal Solr.

• WordPress:

  • Migrate to Elasticsearch before January 11, 2027.

PHP versions 8.2.31, 8.3.31, 8.4.21, and 8.5.6 are now available on the platform. These updates include important security fixes, along with bug fixes and enhancements that improve performance and stability. Updates will be applied automatically over the next few days, so no manual action is required.

PHP 7.2, 7.3, and 8.0 have reached End of Sale on the Pantheon platform. New sites can no longer be created using these PHP versions.

This was previously announced in the PHP version removal schedule published March 11, 2026.

These versions, along with PHP 5.6, 7.0, and 7.1, are scheduled for removal on September 30, 2026. Sites still running a removed PHP version will be automatically upgraded to the oldest available PHP version at the time of removal.

Action required

If your site is running PHP 7.2, 7.3, or 8.0, upgrade to a recommended PHP version before September 30, 2026 to avoid disruption. Pantheon recommends PHP 8.3 or 8.4 for all production sites.

For guidance on upgrading, refer to Upgrade PHP Versions.

Sites created with custom upstreams that specify an end-of-sale PHP version may also experience unexpected behavior upon site creation.