php2shell
Menu

Pantheon and the PHP2Shell fix

The host says it is installing the fix now.

What Pantheon says

Pantheon opened a status incident on 2026-10-21 titled 'PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619'. It lists targeted fixed versions (8.5.12, 8.4.27, 8.3.36, 8.2.35), says older branches are patched via an LTS vendor, and reports runtime configuration changes and network-level payload filtering. Staged rollout of fixed builds began at 07:36 PDT; as of 10:17 PDT it was still rolling out. Pantheon says no customer action is required, and encourages customers on end-of-sale PHP versions to upgrade.

Pantheon is actively mitigating against the PHP security vulnerabilities announced at 14:00 UTC today.
status.pantheon.io2026-10-21Official
Updated PHP versions addressing CVE-2026-109618 and CVE-2026-109619 are now available
stspg.io2026-10-21Official
No action is required from customers.
stspg.io2026-10-21Official
Patches continue rolling out across the infrastructure in stages
stspg.io2026-10-21Official

What you need to do

Pantheon says none required. Customers on end-of-sale PHP versions (e.g. 7.4 sells until 2026-12-31; 8.1 and older are end of support) should upgrade to 8.2 or newer.

Check which PHP your site runs

Site Dashboard > Settings > PHP version

In WordPress, Tools › Site Health › Info › Server shows the PHP version. Paste it into the version check to see whether it is fixed.

Switch to a supported version

Set php_version in pantheon.yml at the repository root (SFTP or Git mode)

Versions offered: 8.5, 8.4, 8.3, 8.2, 7.4 (not recommended).

If you can, choose PHP 8.4. It is fixed, supported until 31 December 2028 and runs almost all current plugins. See which version to choose.

Old PHP versions

We found no paid support for old PHP versions at Pantheon.

Ask Pantheon directly

Copy this into a support ticket and fill in the parts in square brackets.

Hello Pantheon support,

PHP released fixes for CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2) on 21 October 2026: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

My account: [account or contract number]
My site: [domain]
PHP version shown in my control panel: [version]

Please confirm:
1. Whether the PHP that serves my site has been updated to one of the fixed releases, or to a build with the fix backported, and the exact version.
2. Whether the PHP processes for my site have been restarted since the update.
3. If not yet, when you expect to finish.
4. If my version is 8.1 or older, which supported version you recommend I switch to.

Thank you.

Pages we read