Patch PHP on Pantheon

Applies to: WordPress sites using Pantheon’s version-controlled environments. Official documentation checked 21 October 2026, 14:11 UTC. Pantheon manages PHP point releases; choosing a branch is separate from confirming this incident’s platform rollout.

Walkthrough

1. Record the site/environment and current PHP version in Site Dashboard → Settings → PHP version. Preserve a backup and use Dev/Test or an appropriate existing Multidev for compatibility testing.
2. Ask Pantheon support whether the build serving your environments already includes CVE-2026-109618 and CVE-2026-109619. If the current branch has been fixed, no branch migration is needed merely to patch PHP.
3. If a branch upgrade is necessary, use your normal Git workflow. In the Site Dashboard’s Dev environment, select Git mode. Edit pantheon.yml at the repository root, preserving its other settings and setting php_version to the compatible supported branch chosen with Pantheon. Example branch setting: php_version: 8.4.
4. Commit and push the change, test the effective runtime, then deploy through the normal tested code promotion process to the production environment. Do not deploy a pantheon.yml change as a hotfix: the PHP guide says such changes are not detected.
5. Check Multidev separately. An environment created after a branch’s earlier configuration change may need a further committed pantheon.yml modification for detection. Pantheon PHP workflow, configuration reference

Verify remediation

You cannot pin an exact PHP point release in pantheon.yml; Pantheon controls those updates. Require its incident-specific build/rollout evidence across Dev, Test, Live and other exposed environments, including worker replacement. First fixed upstream releases are 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12; documented vendor backports may differ.

In each WordPress environment, check Tools → Site Health → Info → Server and test login, forms, uploads and checkout. Record the actual web runtime and support confirmation.

If blocked or broken

Contact Pantheon support for a patch ETA and restrictions on exposed environments if completion is unconfirmed. Restore a compatible application deployment on patched PHP where possible. A rollback to a vulnerable runtime must stay isolated until repaired; see the validation and rollback guide. Older branch examples in general documentation are not safe-version advice for this incident.

Fixed versions

Support request

Fill in the brackets and send it to Pantheon support. Ask for a written answer and keep it in your change record.

Subject: Urgent: confirm PHP patches for CVE-2026-109618 / CVE-2026-109619

Please confirm the status for these managed WordPress sites:

- Hosting account: [account reference]
- Domains, including staging: [list]

PHP's 21 October 2026 security release fixes CVE-2026-109618 and CVE-2026-109619. Please provide:

- The complete installed PHP version/build or vendor revision and evidence that it fixes both CVEs.
- Confirmation that the update covers every serving node/PHP handler for these sites and that old workers have been replaced.
- The completion time, or a concrete ETA if still pending.
- Any site-owner action needed, and an access restriction option if the runtime cannot be patched promptly.

Please also confirm the available backup/recovery path before any PHP branch change.

Sources

• Pantheon PHP workflow docs.pantheon.io
• configuration reference docs.pantheon.io

Researched from Pantheon’s public documentation on 21 October 2026, 14:11 UTC, not inside a Pantheon account. Menu labels can vary by plan, region or dashboard revision. A citation verifies the documented procedure, not that Pantheon has finished rolling out the patch for your site. Clarity Messaging is not affiliated with Pantheon.

Other hosts: SiteGround · GoDaddy · Flywheel · WP Engine · Kinsta · Bluehost · Hostinger · HostGator · DreamHost / DreamPress · Cloudways · Pressable · WordPress.com · Nexcess / Liquid Web · InMotion Hosting · hosting.com / former A2 Hosting · GreenGeeks · Namecheap · IONOS · WPX