Pantheon release notes

Pantheon MU-Plugin 1.5.7 adds dismiss and hide controls for the Pantheon WordPress core update notice ("A new WordPress update is available!"). Apply upstream updates to get this version of the mu-plugin.

Dismiss the notice

Any user who sees the notice can dismiss it with the X in the corner. The dismissal is saved per user, so it persists across page loads and logins. The notice reappears only when a newer WordPress version becomes available.

Hide the notice

To hide the notice more permanently, or for everyone, you can:

• Target #pantheon-update-notice (or the .pantheon-update-notice class) with CSS.
• Return false from the pantheon_show_update_notice filter.
• Define the PANTHEON_SHOW_UPDATE_NOTICE constant as false in wp-config.php.

For details, see Suppress WordPress Admin Notice.

All Pantheon-maintained Drupal modules and WordPress plugins have been confirmed compatible with PHP 8.5. Some required code updates and received new releases; others were already compatible.

Drupal modules

The following Drupal modules have been updated for PHP 8.5 compatibility:

• Pantheon Advanced Page Cache 2.4.0
• Pantheon Secrets 1.1.0
• Search API Pantheon 8.5.0
• Pantheon Content Publisher 1.0.5
• Pantheon Domain Masking 2.2.0

WordPress plugins

The following WordPress plugins have been updated for PHP 8.5 compatibility:

• Pantheon Advanced Page Cache 2.1.2
• WP Redis 1.4.7
• WP Native PHP Sessions 1.4.5
• Pantheon HUD 0.4.5
• WP SAML Auth 2.3.4
• Pantheon Content Publisher 1.3.6
• Pantheon MU Plugin 1.5.7

To switch your site to PHP 8.5, see Upgrade PHP Versions.

Pantheon has released version 2.3.4 of the WP SAML Auth WordPress plugin.

Version 2.3.3 was released on August 11, 2026 with a security fix for SAML user matching. The 2.3.3 package published to the WordPress Plugin Repository was missing its vendor directory, which includes the bundled onelogin/php-saml library, so sites that took that update could not authenticate through SAML. Version 2.3.4 was released the following day to correct the packaging, and it carries the 2.3.3 security fix as well. Both releases are one day apart, so a site may be on either version depending on when it last updated.

What's new

• Security: user matching now accent-sensitive — Fixes an account takeover where an accent-insensitive database collation could match a SAML attribute to the wrong WordPress user. User lookup is now verified with a case-insensitive, accent-sensitive comparison. Originally released in 2.3.3.
• Restores the bundled SAML library — The vendor directory, which includes onelogin/php-saml, is included in the package again. Sites affected by 2.3.3 will be able to authenticate through SAML after updating.

Who is affected

• Sites on 2.3.2 or earlier are missing the security fix and should update to 2.3.4.
• Sites on 2.3.3 installed from the WordPress Plugin Repository, using the WordPress dashboard, WP-CLI, or the direct download, have the security fix but may be unable to authenticate through SAML. Update to 2.3.4 to restore login.
• Sites that install the plugin with Composer are unaffected by the packaging issue, because onelogin/php-saml is resolved as a dependency rather than from the bundled copy. These sites should still update to 2.3.4 if they are on 2.3.2 or earlier.

Update to 2.3.4 from the WordPress dashboard under Plugins > Installed Plugins, or download it from the WordPress Plugin Repository.

For more details, see the plugin release notes.

The latest security release for WordPress, 7.0.4, is available on Pantheon.

Action required

Because this is a security update, we recommend all users upgrade to WordPress 7.0.4 as soon as possible from your Pantheon dashboard or Terminus to access the latest features, fixes, and security enhancements. See related documentation for how to apply core updates.

Pantheon has pre-deployed platform-wide mitigations (virtual patching via our routing network) against external abuse of the vulnerability, and are actively monitoring those rules. However, customers need to update their sites as soon as possible.

Highlights

This update resolves a security vulnerability:

• An authenticated Author+ remote code execution via malicious file upload (CVE-2026-65640).

For more information on this release, please see the WordPress documentation.

The latest security release for WordPress, 7.0.3, is available on Pantheon.

Action required

Because this is a security update, we recommend all users upgrade to WordPress 7.0.3 as soon as possible from your Pantheon dashboard or Terminus to access the latest features, fixes, and security enhancements. See related documentation for how to apply core updates.

Pantheon has pre-deployed platform-wide mitigations (virtual patching via our routing network) against external abuse of the vulnerability, and are actively monitoring those rules. However, customers need to update their sites as soon as possible.

Highlights

This update resolves a number of security vulnerabilities, including:

• A pre-authentication reflected XSS attack that can lead to remote code execution
• Several other XSS issues that require an authenticated user

The RCE vulnerability is serious, but unlike wp2shell it requires specific targeting of a user to be effective. However, it is present on all versions of WordPress going back to 4.7.

Backports

Backport patches for older branches of WordPress have been published to our WordPress upstream. Customers on an older branch should update to the patched release for their branch:

6.9.6, 6.8.7, 6.7.6, 6.6.6, 6.5.9, 6.4.9, 6.3.9, 6.2.10, 6.1.11, 6.0.13, 5.9.15, 5.8.14, 5.7.16, 5.6.18, 5.5.19, 5.4.20, 5.3.22, 5.2.25, 5.1.23, 5.0.26

For more information on this release, please see the WordPress documentation.

The latest security release for WordPress, 7.0.2, is available on Pantheon as of July 17, 2026.

Action required

Because this is a security update, we recommend upgrade to WordPress 7.0.2 as soon as possible from your Pantheon dashboard or Terminus to access the latest features, fixes, and security enhancements. See related documentation for how to apply core updates.

Highlights

This update resolves two security vulnerabilities that were reported via WordPress core's HackerOne reporting portal. Fixes in this release include:

• A facilitated SQL injection issue
• A REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

WordPress 6.9 is affected by both vulnerabilities. Version 6.9.5 has been released with fixes for both and is also available from our WordPress upstream.

WordPress 6.8 is only affected by the first vulnerability. Version 6.8.6 has been released with the fix and is available from our WordPress upstream.

For more information on this release, please visit the HelpHub site.

Sites can now compile frontend assets (themes, design systems, and other Node.js-based tooling) automatically as part of the build process.

When enabled, Pantheon installs your Node.js dependencies and runs your build script for each configured path on every code push, so compiled assets no longer need to be committed to your repository. Frontend builds work on any site, whether or not you use Integrated Composer.

Enable frontend builds

Add a frontend_build block to your pantheon.yml file:

Pantheon selects a package manager automatically based on the lock file present in each build path. Supported package managers include bun, pnpm, yarn, and npm.

For full configuration details and examples, see the frontend asset builds documentation.

Elasticsearch is now available as an add-on for WordPress sites on Pantheon for all Performance sites and above. This new capability is powered by ElasticPress, the leading Elasticsearch solution for WordPress.

What's included?

ElasticPress improves the overall search experience and performance of your WordPress sites, as well as allowing for better WP_Query performance and reduced load on your application server. Capabilities include:

• Full-text search — Fuzzy matching, synonyms, and weighted fields for more relevant search results.
• Instant Search — Real-time search-as-you-type results without full page reloads.
• WP_Query integration — ElasticPress allows you to offload WP_Query requests to Elasticsearch, reducing database load and improving page load times.
• Faceted filtering — Narrow results by category, tag, custom taxonomy, and other attributes.
• WooCommerce support — Product search and filtering for WooCommerce storefronts.
• Related content — Surface related posts and pages automatically.
• Custom content indexing — Index posts, pages, custom post types, and custom fields.

Who has access?

Elasticsearch is available to WordPress sites on Performance Small plans and above.

How to enable it

Review the Setup and Configuration documentation for detailed instructions on setting up Elasticsearch and ElasticPress.

More information

For additional guidance and a walkthrough of these features, see the Elasticsearch on Pantheon documentation.