PHP versions 8.2.33, 8.3.33, 8.4.24, and 8.5.9 are now available on the platform. These releases address three security issues, along with bug fixes and enhancements that improve performance and stability.
The most notable of these is CVE-2026-17543, a high-severity SQL injection in PHP's PostgreSQL extension (ext-pgsql) affecting pg_insert(), pg_update(), pg_select(), and pg_delete(). It is resolved by this update. Only sites using ext-pgsql to connect to an external PostgreSQL database were affected; Pantheon's own MySQL/MariaDB databases are not.
The remaining fixes are an out-of-bounds write in BCMath's bccomp() (CVE-2026-17544, affecting PHP 8.4 and 8.5) and a crash triggered by recursive symlinks in the Phar extension (CVE-2026-7260). PHP 8.5.9 and 8.4.24 also include an updated libgd (CVE-2026-9672).
Updates will be applied automatically over the next few days, so no manual action is required.