Pantheon release notes

PHP 8.1 has reached End of Sale on the Pantheon platform. Newly created sites after September 30 2026 will no longer be able set their PHP version to 8.1.

Sites already running PHP 8.1 continue to run. They keep receiving LTS security coverage through PHP Runtime Generation 2, with no action required. A removal date for PHP 8.1 has not been set, and Pantheon guarantees at least 90 days of advance notice before removing any PHP version from the platform.

Action required

If you maintain a custom upstream that sets php_version: 8.1 in pantheon.upstream.yml, update it to a supported version. New sites created from that upstream may otherwise behave unexpectedly on creation.

If your site runs PHP 8.1, plan an upgrade to a recommended PHP version. Pantheon recommends PHP 8.3 or 8.4 for all production sites. For steps, see Upgrade PHP Versions.

Pantheon is renaming machine tokens to personal access tokens (PATs) and adding stronger security controls with automatic expiration.

What’s changed

• Time-bound credentials: New PATs expire 90 days after creation, reducing the risk of credentials that remain valid indefinitely.

What hasn’t changed

• Continue using the same Terminus flow and commands for authentication, listing, and deleting tokens.
• Continue to create and revoke tokens in the dashboard under your User settings.

What this means for legacy machine tokens

Existing machine tokens continue to work and are not changed by this release. No immediate action is required. Machine tokens are now considered a legacy authentication method, so we recommend using personal access tokens for new integrations and workflows.

If you adopt a PAT, plan to renew it every 90 days and update the corresponding secret wherever the token is used.

Get started

Create a new personal access token from User settings → Personal Access Tokens, copy it once, store it securely, and use it with your existing Terminus authentication workflow.

For more details, see related documentation.

Pantheon is beginning the phased migration of Advanced Global CDN (AGCDN) to our next-generation edge platform. Starting September 30, 2026, AGCDN customers whose current configuration is fully supported in Phase 1 are eligible to migrate. Pantheon will contact eligible customers directly.

What's included

Once your migration is complete, you control your edge settings yourself in the Pantheon Dashboard. Changes no longer require a request to Pantheon. Phase 1 controls are configured at the workspace level, apply to every site and environment in the workspace, and are enforced at the edge before requests reach your site.

• IP and CIDR blocking
• Geo blocking
• ASN blocking
• Enterprise WAF
• Image Optimization

How migration works

This migration is not self-serve. Pantheon's Professional Service will:

1. Review your current Legacy AGCDN configuration and confirm feature support with current capabilities on NextGen.
2. Migrate your supported rules and configuration.
3. Make the migrated configuration available for you to review.
4. Coordinate the DNS cutover with you during an agreed change window.
5. Validate the configuration after cutover.

Action required

If you are eligible for Phase 1, you will receive an email. Respond to the ticket to confirm your technical contact so we can schedule your migration.

AGCDN customers who are not contacted for Phase 1 don't need to do anything at this time, and will be contacted at a later date.

Learn more about our switch to Next-generation GCDN with bot protection in this related blog post.

Version 1.4.1 of the Pantheon Content Publisher WordPress plugin is now available.

What's new?

Improved how Smart Components are placed in your posts and pages, including in the Content Publisher preview. #261

Update to 1.4.1 from the WordPress dashboard under Plugins > Installed Plugins, or download it from the WordPress Plugin Repository.

For more details, see the plugin changelog.

Pantheon is announcing that, as of December 31, 2026, PHP version 7.4 will enter End of Sale. As a result, no new sites can be created with this version after that date.

What happens to existing sites when a PHP version reaches End of Sale?

Existing sites running an end-of-sale PHP version will not be affected. Pantheon will continue to apply security patches for PHP 7.4 where available for the duration of End of Sale.

What to expect going forward

In the future, we expect to transition PHP 7.4 to End of Support status. When this happens, this version will no longer be supported by PHP maintainers, nor will Pantheon provide ongoing updates from our contracted vendors. Customers will assume additional security risk by staying on these versions. Pantheon commits to providing at least 90 days advance notice to customers before transitioning a version of PHP to End of Support.

Action required

If your site is running PHP 7.4, we encourage you to upgrade it to a current PHP version. We recommend PHP 8.3 or 8.4 for all production sites.

For guidance on upgrading, refer to Upgrade PHP Versions.

PHP versions 8.2.34, 8.3.35, 8.4.26, and 8.5.11 are now available on the platform. These updates include important security fixes, along with bug fixes and enhancements that improve performance and stability.

The security fixes include a high-severity issue in the SOAP extension (CVE-2026-91765), plus fixes in OpenSSL certificate verification, the HTTP stream wrapper, and PHP-FPM.

Updates will be applied automatically over the next few days, so no manual action is required. See PHP versions on Pantheon to check or change your site's PHP version.

The latest security release for WordPress, 7.1.2, is available on Pantheon.

Action required

Because this is a security update, we recommend all users upgrade to WordPress 7.1.2 as soon as possible from your Pantheon dashboard or Terminus to access the latest features, fixes, and security enhancements. See related documentation for how to apply core updates.

Pantheon has pre-deployed platform-wide mitigations (virtual patching via our routing network) against external abuse of this vulnerability (CVE-2026-87902), and is actively monitoring those rules. However, customers need to update their sites as soon as possible.

Highlights

This release resolves one critical severity vulnerability (CVE-2026-87902) that does not require authentication to exploit. Under certain server and theme conditions, an unauthenticated attacker can cause page template resolution to include a chosen readable local PHP file outside the active theme directories, which could potentially lead to remote code execution.

For full details, see the WordPress 7.1.2 release notes and WordPress documentation.

The latest security release for WordPress, 7.1.1, is available on Pantheon.

Action required

Because this is a security update, we recommend all users upgrade to WordPress 7.1.1 as soon as possible from your Pantheon dashboard or Terminus to access the latest features, fixes, and security enhancements. See related documentation for how to apply core updates.

Pantheon has pre-deployed platform-wide mitigations (virtual patching via our routing network) against external abuse of some of these vulnerabilities, and are actively monitoring those rules. This includes an unauthenticated stored cross-site scripting vulnerability (CVE-2026-93485), reported through Patchstack's Vulnerability Disclosure Program, which was already covered by these mitigations ahead of the release. However, customers need to update their sites as soon as possible.

Highlights

This release resolves 11 security vulnerabilities, most requiring an authenticated role (Contributor or above) to exploit. WordPress has not assigned CVE identifiers to these issues.

For full details, see the WordPress 7.1.1 release notes and WordPress documentation.