Pantheon Operations Status

Investigating: Pantheon is actively mitigating against the PHP security vulnerabilities announced at 14:00 UTC today. PHP environments are being patched to the following versions:

8.5.12 8.4.27 8.3.36 8.2.35

Additionally, we are patching the following heirloom PHP branches via our LTS vendor:

8.1.x 8.0.x 7.4.x 7.3.x 7.2.x 7.1.x 7.0.x 5.6.x

Finally, in preparation for this event, we pre-emptively deployed configuration changes to the runtime environment to mitigate potential attack vectors, and have implemented network-level mitigations to deflect attempted exploit payloads across the platform.

No action is required from customers, as all available versions of PHP on Pantheon receive security updates through our LTS vendor. However, we continue to recommend that customers running on older versions of PHP that have reached End of Sale update to a version fully supported by the PHP community in order to minimize their overall risk.

To pin your version of PHP to a different version, see https://docs.pantheon.io/guides/php/php-versions.

We will update this post as patching progresses and as we learn more about the vulnerability.

Resolved: This incident has been resolved.

Monitoring: A fix has been implemented and we are monitoring the results.

Identified: We have identified an issue affecting only Terminus workflows and commands, including Terminus authentication and API requests. Some Terminus requests may fail or time out.

Our Engineering team is working to restore Terminus service. There is currently no confirmed workaround or estimated time to resolution.

The Pantheon Dashboard and sites remain unaffected.

If you need immediate assistance, please open a chat with our Support bot and request an urgent Support ticket, or email [email protected] for direct assistance.

Resolved: Drupal Steward protection is in place for some known attack vectors related to CVE-2026-108097. This reduces exposure, but does not cover every possible exploit path or replace applying the security update. No customer impact is currently reported, and we continue to monitor.

Patched Drupal 10 and 11 releases are available through Integrated Composer, and Drupal 7.107 is available as an upstream update. Please update affected sites as soon as possible. If you cannot update immediately, uninstall the core Field UI module (field_ui) as a temporary mitigation.

See the Drupal core security update and <a href=-"https://docs.pantheon.io/release-notes/2026/10/drupal-7-107-security-update">Drupal 7.107 security update for details.

Monitoring: Drupal 10 and 11 security updates are available through Integrated Composer, and the Drupal 7.107 upstream security update has been released. Release notes are available for both update paths: Drupal core security update and Drupal 7.107 security update.

Monitoring: Drupal 7.107 is now available as an upstream update.

Customers running Drupal 7 applications should update to Drupal 7.107 as soon as possible. To apply the update, use the Drupal core update workflow in the Pantheon Dashboard.

Monitoring: We are aware of the Drupal 7 release and will update this incident when it is available as an upstream update.

Monitoring: A Drupal core security release is now available for CVE-2026-108097 (risk 19/25). It fixes a critical remote code execution vulnerability in the Field UI module.
Drupal core alone is not directly exploitable, but several exploit paths exist through contributed modules, including at least one path that does not require authentication. Custom code can also expose the vulnerable functionality.

Action required

Drupal 12.0.0-alpha1 through 12.0.0-beta1 are also affected. See the Drupal security advisory for Drupal 12 remediation details. Drupal 11.2.x and earlier, Drupal 10.5.x and earlier, Drupal 9, and Drupal 8.9 are end-of-life. These versions are affected and do not receive security patches. Upgrade sites on these versions to a supported Drupal release.

To apply the update, use the Drupal core update workflow in the Pantheon Dashboard. See the Pantheon security release note for instructions.

Mitigation until you update

As a founding Platform Partner of the Drupal Steward program, Pantheon provides protection against some known attack vectors. Drupal Steward does not cover all possible exploits, so it does not replace updating your site.