Pantheon release notes

Version 1.4.1 of the Pantheon Content Publisher WordPress plugin is now available.

What's new?

Improved how Smart Components are placed in your posts and pages, including in the Content Publisher preview. #261

Update to 1.4.1 from the WordPress dashboard under Plugins > Installed Plugins, or download it from the WordPress Plugin Repository.

For more details, see the plugin changelog.

Pantheon is announcing that, as of December 31, 2026, PHP version 7.4 will enter End of Sale. As a result, no new sites can be created with this version after that date.

What happens to existing sites when a PHP version reaches End of Sale?

Existing sites running an end-of-sale PHP version will not be affected. Pantheon will continue to apply security patches for PHP 7.4 where available for the duration of End of Sale.

What to expect going forward

In the future, we expect to transition PHP 7.4 to End of Support status. When this happens, this version will no longer be supported by PHP maintainers, nor will Pantheon provide ongoing updates from our contracted vendors. Customers will assume additional security risk by staying on these versions. Pantheon commits to providing at least 90 days advance notice to customers before transitioning a version of PHP to End of Support.

Action required

If your site is running PHP 7.4, we encourage you to upgrade it to a current PHP version. We recommend PHP 8.3 or 8.4 for all production sites.

For guidance on upgrading, refer to Upgrade PHP Versions.

PHP versions 8.2.34, 8.3.35, 8.4.26, and 8.5.11 are now available on the platform. These updates include important security fixes, along with bug fixes and enhancements that improve performance and stability.

The security fixes include a high-severity issue in the SOAP extension (CVE-2026-91765), plus fixes in OpenSSL certificate verification, the HTTP stream wrapper, and PHP-FPM.

Updates will be applied automatically over the next few days, so no manual action is required. See PHP versions on Pantheon to check or change your site's PHP version.

The latest security release for WordPress, 7.1.2, is available on Pantheon.

Action required

Because this is a security update, we recommend all users upgrade to WordPress 7.1.2 as soon as possible from your Pantheon dashboard or Terminus to access the latest features, fixes, and security enhancements. See related documentation for how to apply core updates.

Pantheon has pre-deployed platform-wide mitigations (virtual patching via our routing network) against external abuse of this vulnerability (CVE-2026-87902), and is actively monitoring those rules. However, customers need to update their sites as soon as possible.

Highlights

This release resolves one critical severity vulnerability (CVE-2026-87902) that does not require authentication to exploit. Under certain server and theme conditions, an unauthenticated attacker can cause page template resolution to include a chosen readable local PHP file outside the active theme directories, which could potentially lead to remote code execution.

For full details, see the WordPress 7.1.2 release notes and WordPress documentation.

The latest security release for WordPress, 7.1.1, is available on Pantheon.

Action required

Because this is a security update, we recommend all users upgrade to WordPress 7.1.1 as soon as possible from your Pantheon dashboard or Terminus to access the latest features, fixes, and security enhancements. See related documentation for how to apply core updates.

Pantheon has pre-deployed platform-wide mitigations (virtual patching via our routing network) against external abuse of some of these vulnerabilities, and are actively monitoring those rules. This includes an unauthenticated stored cross-site scripting vulnerability (CVE-2026-93485), reported through Patchstack's Vulnerability Disclosure Program, which was already covered by these mitigations ahead of the release. However, customers need to update their sites as soon as possible.

Highlights

This release resolves 11 security vulnerabilities, most requiring an authenticated role (Contributor or above) to exploit. WordPress has not assigned CVE identifiers to these issues.

For full details, see the WordPress 7.1.1 release notes and WordPress documentation.

Version 1.4.0 of the Pantheon Content Publisher WordPress plugin is now available.

What's new?

New Feature: Smart Components ** You can now embed videos and interactive smart components directly into your posts and pages using the updated Google Docs add-on. #206

Update to 1.4.0 from the WordPress dashboard under Plugins > Installed Plugins, or download it from the WordPress Plugin Repository.

For more details, see the plugin changelog.

Starting September 10, 2026, new sites created on Pantheon are provisioned on the next-generation Global CDN, powered by Cloudflare, instead of the legacy Global CDN.

This change applies to newly created sites only. Existing sites are not affected and remain eligible for migration through the normal migration path.

No action is required: the next-generation GCDN is provisioned automatically at site creation.

Advanced Global CDN (AGCDN) customers are not affected by this change. If you have any questions, contact Pantheon Support.

Sites on the Next Generation GCDN can now exempt their own trusted automation from bot protection, without contacting support.

Bot protection on the Next Generation GCDN automatically challenges traffic that looks automated. That is the right default for scrapers and attack tools, but it can also challenge automation you rely on: uptime monitors, CI/CD pipelines, feed importers, and custom API clients that are not on the verified bot list.

You can now generate a bot bypass token for your site using Terminus and configure your automation to send it in the x-pantheon-bot-bypass request header. Requests carrying a valid token skip the standard challenge applied to automated traffic; targeted protections, rate limiting, and the managed WAF still apply to every request.

Key details:

• Tokens are scoped to a single site (all environments) and valid for 6 months. The command returns a current token and a next token that becomes valid 3 months later; both are accepted during the overlap. Send the current token now, switch to the next token on or after its start date, and re-run the command each quarter to pick up the following pair.
• Treat the token like a credential. Send it only from trusted servers and services, and never expose it in client-side code. If a token is leaked, contact Pantheon support to revoke it; a replacement token becomes available at the start of the following month.
• Requests without the header are evaluated by bot protection as usual. Requests with an incorrect token are rejected with a 403, so check the header value first if your automation starts failing.

See Bot Bypass Tokens in the Next Generation GCDN guide for setup instructions.