Pantheon outage history

RESOLVED: PHP CVE-2026-115560 mitigation Pantheon is aware of the release of CVE-2026-115560 from PHP.net; the recommended remediations for this vulnerability were already in place prior to the announcement. No action is required.

We are investigating an issue affecting environment creation. Customers may be unable to create new Drupal or WordPress sites, test environments, or Multidev environments through the Dashboard or Terminus. In some cases, an environment may appear in the environment list but return an error when accessed. Engineering is investigating the underlying provisioning issue. We will provide another update as more information becomes available.

A fix has been implemented for the environment creation issue, and we are monitoring the results. Customers should see creation of new Drupal and WordPress sites, test environments, and Multidev environments through the Dashboard and Terminus return to normal. We are continuing to verify successful environment creation and will provide another update once monitoring is complete.

The environment creation issue has been resolved. Creation of new Drupal and WordPress sites, test environments, and Multidev environments through the Dashboard and Terminus has returned to normal. Monitoring is complete, and environment creation is operating as expected.

Pantheon is actively mitigating against the PHP security vulnerabilities announced at 14:00 UTC today. PHP environments are being patched to the following versions: 8.5.12 8.4.27 8.3.36 8.2.35 Additionally, we are patching the following heirloom PHP branches via our LTS vendor: 8.1.x 8.0.x 7.4.x 7.3.x 7.2.x 7.1.x 7.0.x 5.6.x Finally, in preparation for this event, we pre-emptively deployed configuration changes to the runtime environment to mitigate potential attack vectors, and have implemented network-level mitigations to deflect attempted exploit payloads across the platform. No action is required from customers, as all available versions of PHP on Pantheon receive security updates through our LTS vendor. However, we continue to recommend that customers running on older versions of PHP that have reached End of Sale update to a version fully supported by the PHP community in order to minimize their overall risk. To pin your version of PHP to a different version, see https://docs.pantheon.io/guides/php/php-versions. We will update this post as patching progresses and as we learn more about the vulnerability.

Updated PHP versions addressing CVE-2026-109618 and CVE-2026-109619 are now available, and we are beginning the process of rolling them out across our infrastructure. No action is required from customers. We will continue to update this post as the rollout progresses.

Patching work is still in progress. Environments are being updated in stages, and protective mitigations remain active across the platform while the remaining updates complete. We are not yet seeing evidence of any volumetric exploit attempts. No customer action is needed. We will provide further updates as the rollout progresses.

Patches continue rolling out across the infrastructure in stages, and protective mitigations remain active. We have not observed any volumetric exploit attempts, and no customer action is required.

Patching continues to roll out across the infrastructure in stages, with protective mitigations remaining active. We have not observed any volumetric exploit attempts, and no customer action is required. We expect to provide an estimated completion time for the patching rollout within the next hour.

We estimate the complete rollout for live environments on supported PHP versions (8.2 -> 8.5) within the next 20 minutes. We are also prioritizing pre-production environments for paying customers, and have preemptively patched development or mutli-dev environments that were toggled into a mutable code state (“SFTP mode”). We will provide an update on LTS versions of PHP (8.1.x through 5.6.x) once our upstream vendor has backported the patches and made updates available. That work has been in progress since 14:00 UTC. Our network-level mitigations remain effective, and are blocking a low but slowly increasing level of activity which is probing the vulnerable surface area. At this time we do not see evidence of widespread exploitation attempts, or any successful exploits. We will continue to deliver patched versions of PHP as quickly as possible, and maintain network level mitigation and continuous monitoring to provide our customers and the wider PHP community insights into how this situation plays out

We have patched all live production sites running supported PHP versions (8.2 - 8.5).

We have received LTS updates from our upstream vendor and are working to deploy the patch to older versions of PHP. We will post an update on that once it is complete or we have a clear ETA. Our network-level mitigations remain effective and we see no evidence of compromise for any sites on the platform.

Patched PHP builds are now available for all supported long-term support (LTS) PHP versions, and rollout to live environments running end-of-life PHP versions is underway. Live environments running fully supported PHP versions (8.2 and later) have already been patched.

We have completed patching production environments for all sites running LTS versions of PHP.

Patched PHP builds have been deployed to all LTS environments, all environments in SFTP mode, and all live environments running PHP 8.2 or later. Most paid non-live environments running PHP 8.2 or later are also patched. We expect the remaining rollout to continue over the next 24 to 48 hours.

We can now confirm that all pre-production customer environments are patched. Free/sandbox environments will be updated over the next 24-48 hours. Over the course of today, our network-level mitigations have blocked over 60,000 suspicious requests probing the vulnerability, and remain in place. This concludes our ongoing updates. We will share more analysis in the future based on what we can observe, but as of now, active mitigation work is complete.

Overnight monitoring continues to show persistent but limited probing, which is being blocked. Our rollout of updated PHP images across customer environments including LTS versions was complete as of 5pm Pacific time yesterday. We will continue to observe and may provide further analysis of our findings, but we are closing this incident.

We have identified an issue affecting only Terminus workflows and commands, including Terminus authentication and API requests. Some Terminus requests may fail or time out. Our Engineering team is working to restore Terminus service. There is currently no confirmed workaround or estimated time to resolution. The Pantheon Dashboard and sites remain unaffected. If you need immediate assistance, please open a chat with our Support bot and request an urgent Support ticket, or email [email protected] for direct assistance.

A fix has been implemented and we are monitoring the results.

This incident has been resolved.

A Drupal core security release is now available for CVE-2026-108097 (risk 19/25). It fixes a critical remote code execution vulnerability in the Field UI module. Drupal core alone is not directly exploitable, but several exploit paths exist through contributed modules, including at least one path that does not require authentication. Custom code can also expose the vulnerable functionality. Action required Update your Drupal sites to a patched release as soon as possible: Drupal 11.4.10 Drupal 11.3.19 Drupal 10.6.19 Drupal 12.0.0-alpha1 through 12.0.0-beta1 are also affected. See the Drupal security advisory for Drupal 12 remediation details. Drupal 11.2.x and earlier, Drupal 10.5.x and earlier, Drupal 9, and Drupal 8.9 are end-of-life. These versions are affected and do not receive security patches. Upgrade sites on these versions to a supported Drupal release. To apply the update, use the Drupal core update workflow in the Pantheon Dashboard. See the Pantheon security release note for instructions. Mitigation until you update If you cannot update immediately, uninstall the core Field UI module ( field_ui ). The Drupal Security Team states that this protects your site until you update. As a founding Platform Partner of the Drupal Steward program , Pantheon provides protection against some known attack vectors. Drupal Steward does not cover all possible exploits, so it does not replace updating your site.

We are aware of the Drupal 7 release and will update this incident when it is available as an upstream update.

Drupal 7.107 is now available as an upstream update. Customers running Drupal 7 applications should update to Drupal 7.107 as soon as possible. To apply the update, use the Drupal core update workflow in the Pantheon Dashboard.

Drupal 10 and 11 security updates are available through Integrated Composer, and the Drupal 7.107 upstream security update has been released. Release notes are available for both update paths: Drupal core security update and Drupal 7.107 security update .

Drupal Steward protection is in place for some known attack vectors related to CVE-2026-108097 . This reduces exposure, but does not cover every possible exploit path or replace applying the security update. No customer impact is currently reported, and we continue to monitor. Patched Drupal 10 and 11 releases are available through Integrated Composer, and Drupal 7.107 is available as an upstream update. Please update affected sites as soon as possible. If you cannot update immediately, uninstall the core Field UI module (field_ui) as a temporary mitigation. See the Drupal core security update and Drupal 7.107 security update for details.

We are investigating an issue causing workflow failures in the Pantheon Dashboard. Our Engineering team is actively reviewing the issue and working to restore normal functionality. We will provide another update within 1–3 hours, or sooner if more information becomes available.

The issue has been identified and a fix is being implemented.

This incident has been resolved.

The dashboard experienced a temporary increase in errors. The issue has been resolved, and the dashboard is loading normally again. We will continue monitoring to confirm the service remains stable.

We are continuing to monitor for any further issues.

This incident has been resolved.

We are investigating reports that a subset of Pantheon-hosted sites are returning 504 Gateway Timeout errors due to a database server issue. Customers may experience site timeouts or failed page loads, and database migrations for affected environments may also be impacted. Our Engineering team is actively working to restore normal service and verify that affected database operations are completing successfully. Some affected sites have begun recovering, but intermittent errors may continue while the investigation remains ongoing. We will post updates as soon as more information becomes available. If you need immediate assistance, please contact [email protected].

We have identified the cause of the 504 errors affecting the site. Service has been restored, and our verification confirms that uncached requests to the live site are returning successfully. The issue was caused by an interruption of the database server supporting the site. The database has recovered, and our Engineering team is completing cleanup and validating the affected environment, including a previously unsuccessful database migration. We are continuing to monitor the site and will provide another update as soon as more information becomes available. If you continue to experience issues, please contact [email protected].

A fix has been implemented and we are monitoring the results.

This incident has been resolved.

We are investigating an issue causing intermittent errors in the Pantheon Dashboard and some workspace operations. Customers may experience failed page loads or intermittent authorization errors when accessing the Dashboard or managing workspace resources. Our Engineering team is actively reviewing the issue and working to restore normal functionality. We will provide another update within 1–3 hours, or sooner if more information becomes available. If you are unable to access the Dashboard and need urgent assistance, please contact [email protected].

We are continuing to investigate this issue.

A fix has been implemented and we are monitoring the results.

We are continuing to monitor for any further issues.

This incident on Pantheon Dashboard and workspace operations has been resolved.

Beginning September 29, Pantheon identified malicious activity in which an attacker gained control of a customer website and used it to target platform resources. Activity from the compromised site attempted to exploit a Linux kernel vulnerability (CVE-2026-53362) on platform application hosts, and some sites may have briefly experienced interruptions as a result. We have taken the following actions: - Disabled and deleted the affected site. - Accelerated the operating-system and kernel updates already in progress, bringing application hosts to a version that addresses this vulnerability. - Deployed additional platform protections and monitoring. We have notified the affected customer directly. The compromise was limited to that single site; based on the information available to us, we have found no evidence of platform-wide data exfiltration or that this activity exposed data belonging to other customers. We are continuing to review platform activity and will update this advisory if that changes. How to protect your site: Attackers most often gain control of a site through outdated or unmaintained code. Keeping your site current is the most effective protection. We strongly encourage all customers to keep CMS core, plugins, and themes fully updated, remove and delete sites and code you no longer use, and review user and credential access. If you notice unexpected code, deployments, or changes on your site, contact Pantheon Support. We will post updates here as more information becomes available. If you have questions, please contact Pantheon Support.

As our investigation has continued, we have determined that a small number of customer sites — not one — were affected. In each case, the site was first compromised through a weakness in its own application, then used to interact with platform services. We are working directly with the affected customers on cleanup and credential rotation, and we have added platform controls to restrict this activity and detection to identify it going forward. The activity remains limited to the individual affected sites and their own data. We have found no evidence that any other customer's site or data was accessed. What you can do: Keeping your site current is the most effective protection. Please update your CMS core, plugins, themes, and modules to the latest versions; remove plugins, themes, and modules you don't use; and delete sites you no longer need. If you notice unexpected code, deployments, or changes on your site, contact Pantheon Support. We will continue to post updates here.

We are continuing to monitor and work through the remaining remediation and hardening. Our initial response is complete, and we are now working directly with the affected customers on site cleanup and credential rotation. We have added further protections and monitoring to help prevent and detect this type of activity. Based on the information available to us, we have found no evidence that any other customer's site or data was accessed. We will share another update as the remaining work progresses. As a reminder, the most effective protection is keeping your site current: please keep your CMS, plugins, themes, and modules up to date, remove anything you no longer use, review your user and credential access, and contact Pantheon Support if you notice unexpected code, deployments, or other changes on your site.

Remediation and platform hardening remain ongoing. We are continuing to monitor systems closely while working directly with affected customers.

This incident has been resolved.

Some sites experienced brief interruptions while we responded to an issue affecting appserver stability. We completed a rolling security upgrade and restart of appservers across all regions. All known affected sites have recovered, and the platform is operating normally. We are continuing to monitor the platform and complete follow-up hardening work. We apologize for the disruption and appreciate your patience.

We are currently investigating reports of unauthorized access to a small number of Pantheon customer accounts. Our evidence suggests these accounts were accessed using credentials stolen from external third-party data breaches (unrelated to Pantheon). This technique, known as "credential stuffing," relies on reused passwords.

We are continuing to investigate this issue.

Our team is still investigating the issue. The next update will be in 6 hours or when a new major update comes.

We are correcting our initial assessment. Our earlier update said the affected accounts were accessed with passwords stolen in third-party data breaches. Our evidence indicates that credentials were captured on a fraudulent copy of the Pantheon sign-in page. The look-alike page was promoted through paid search results and links, and it forwarded users to the real Pantheon Dashboard after capturing what they typed, so many affected users saw nothing unusual. We have identified and reported one such site. Sites of this kind are usually replaced quickly. We are continuing to search for others and to work with the providers involved. Pantheon's systems were not breached. Once inside an account, the unauthorized party used normal account functions: creating machine tokens, adding SSH keys, and on some affected sites, deploying code to production. We will be contacting affected account holders and site owners directly once we confirm the list of affected accounts, resetting credentials, and revoking tokens and keys on those accounts. If you are not contacted, we have no indication your account was accessed. How to protect your account Sign in only by typing https://dashboard.pantheon.io into your browser or using a bookmark you created. Do not sign in from a search result, a sponsored ad, or a link in an email or chat message, even one that appears to come from Pantheon. Before you type a password, check that the address bar shows dashboard.pantheon.io spelled exactly; look-alike pages differ by a letter or two. Turn on multi-factor authentication for your Pantheon account (Personal Settings, then Security). Instructions: https://docs.pantheon.io/release-notes/2026/04/mfa If you have signed in from a search result or emailed link recently, change your password now, then review your account: remove SSH keys you do not recognize (https://docs.pantheon.io/ssh-keys), revoke machine tokens you did not create (https://docs.pantheon.io/machine-tokens), and check your site and workspace team lists for members you did not add. Pantheon will never ask for your password by email, chat, or phone. Report suspicious sign-in pages or messages to [email protected]. Our security practices and contacts are published at https://pantheon.io/security and https://trust.pantheon.io.

We have identified the cause of this incident and are actively responding. Our evidence indicates the affected accounts were accessed using passwords captured on a fraudulent copy of the Pantheon login page, reached through sponsored search results and not through any compromise of Pantheon's own systems We are securing the affected accounts, resetting credentials, and revoking access created by the unauthorized party. As part of this, you will receive a routine password-reset email. We are also contacting affected account holders and site owners directly; those security notifications will come from [email protected] and are genuine.

We have completed mitigation steps for the compromised accounts, including resetting passwords and revoking unauthorized access, machine tokens, and SSH keys. We are continuing to notify affected account holders and site owners directly. Customers who are affected will receive specific guidance from Pantheon through our support channels. Pantheon’s systems were not compromised. We will continue monitoring the situation and provide further updates as our review progresses.

We have no new developments to share. We're continuing to keep the affected accounts secure, including resetting passwords and revoking any unauthorized access, machine tokens, and SSH keys. Pantheon's systems were not compromised. We're continuing to reach out to affected account holders and site owners directly with guidance on next steps.

We have completed mitigation for this incident. All confirmed affected accounts have had passwords reset and unauthorized access, machine tokens, and SSH keys revoked. All confirmed affected account holders and site owners have been contacted directly. We will continue monitoring the situation and share an update if anything changes.

This incident has been resolved.

We are currently investigating an issue causing 504 errors on a subset of hosted customer sites. Some visitors may experience timeouts or failed page loads. Our team is actively working to identify the root cause. We will post an update as soon as we have more information. If you need immediate assistance: General concerns: Open a chat with our support bot and request to open a ticket for urgent cases. If the Dashboard is inaccessible: Email us directly at [email protected]. We will provide another update within 30–60 minutes, or as soon as new information becomes available. Thank you for your patience.

A fix has been implemented and we are monitoring the results.

This incident has been resolved.

Our Engineering team is currently investigating reports of degraded performance affecting the Dashboard interface. A subset of users may experience slow page loading times or intermittent issues opening site environments. Live hosted sites and environment uptime remain fully operational and unaffected. We are actively working to identify the root cause and restore normal performance as quickly as possible. Need Immediate Assistance? • General concerns: Open a chat with our support bot and request to open a ticket for urgent cases. • If the Dashboard is inaccessible: Email us directly at [email protected]. We will provide another update within 30–60 minutes, or as soon as new information becomes available. Thank you for your patience.

Our team is continuing its investigation into the degraded performance affecting the Dashboard interface. In addition, recent telemetry shows that a small subset of hosted sites is also experiencing performance degradation. We are actively working to mitigate the impact and restore full functionality.

Our investigation indicates that accessibility and performance issues are affecting a subset of hosted sites in addition to the Dashboard. We are treating this as a critical incident, and our engineering team is actively working to isolate the cause and restore service. If you require immediate assistance and the Dashboard is inaccessible, please email us directly at [email protected]. Thank you for your patience while we work to resolve this.

We have identified the root cause of the issue and are actively applying a fix. Telemetry is showing performance improvements across the Dashboard and affected sites. If the Dashboard remains inaccessible and you require immediate assistance, please email us directly at [email protected]. We will share another update shortly as services continue to recover.

Telemetry graphs continue to show steady performance recovery across all impacted services. We are adjusting component statuses to Degraded Performance and actively monitoring systems as they normalize. For urgent assistance, email [email protected].

Most products have recovered and performance is normalizing. Our engineering team is actively validating a few remaining product impacts. For urgent assistance or Dashboard access issues, please contact [email protected].

Our engineering team continues working to resolve the issue across the remaining impacted components. Overall performance across most services continues to improve, and we are actively working toward full recovery. If you are experiencing persistent issues or cannot access the Dashboard, please email us directly at [email protected].

Following remediation efforts, telemetry graphs show that all platform components and hosted sites have recovered to normal operational levels. We have shifted the incident status to Monitoring while our engineering team closely tracks system health and performance. If you encounter persistent issues or the Dashboard remains inaccessible, please reach out directly to [email protected].

A fix has been implemented and we are monitoring the results.

This incident has been resolved.

We are investigating reports of degraded performance affecting the Dashboard interface. A subset of users may experience slow loading times or intermittent issues loading site environments. Live hosted sites and environment uptime are fully operational and unaffected. Our Engineering team is actively working to identify the root cause and restore normal functionality. Need Immediate Assistance? General concerns: Submit a support ticket or reach out via Live Chat. If the Dashboard is inaccessible: Contact us directly at [email protected]. We will provide another update within 30–60 minutes, or as soon as new information becomes available.

A fix has been implemented and we are monitoring the results.

This incident has been resolved.

We are currently investigating degraded performance or failures in certain platform workflows, such as site creation. This may affect your ability to create new sites. Our engineers are actively triaging the issue and working to implement a fix. We’ll post progress updates regularly on this page. We recommend waiting on creation of sites until the issue is resolved.

We are continuing to investigate this issue.

The issue has been identified and a fix is being implemented.

We are continuing to work on a fix for this issue.

A fix has been implemented and we are monitoring the results.

This incident has been resolved.

We are currently investigating degraded performance or failures in certain platform workflows, such as [clones, deploys, backups, or multidev environment creation]. This may affect your ability to [push code, create environments, or run scheduled tasks]. This is affecting sites in the Australia (AU) region. Our engineers are actively working on a fix. We'll post progress updates regularly on this page. We recommend pausing the use of [specific workflow, e.g., deploys to test] until the issue is resolved.

Our engineers have implemented a fix. Customers are advised to retry any affected workflow tasks. We continue to actively monitor the situation. Please reach out to support if you continue to encounter issues.

We have concluded our monitoring period and have deemed this incident resolved. Thank you for your patience. If you encounter any further issues, please open a ticket with us at [email protected].

We are currently investigating degraded performance or failures in certain platform workflows, such as [clones, deploys, backups, or multidev environment creation]. This may affect your ability to [push code, create environments, or run scheduled tasks]. Our engineers are actively working on a fix. We’ll post progress updates regularly on this page. We recommend pausing the use of [specific workflow, e.g., deploys to test] until the issue is resolved.

Investigation is still on-going. We'll provide our next update in an hour, or sooner once the information is available.

Our team is currently in the process of applying measures. Investigation and monitoring remain ongoing. We'll provide our next update in an hour, or sooner once the information is available.

A fix has been implemented and we are monitoring the results.

We are actively observing internal graphs to ensure performance remains stable following recent measures. Further updates will be provided in 2 to 3 hours, or sooner if new information becomes available.

We are continuing to monitor for any further issues.

This incident has been resolved.

We identified an issue causing automated backups to fail. Our engineering team has deployed a fix for the underlying cause and is now monitoring backup workflows across the platform to confirm they complete successfully. Failed backups are expected to run successfully within the next 24 hours. We'll share another update once we've confirmed full backup stability across affected sites.

We are continuing to monitor for any further issues.

This incident has been resolved.

Our internal monitoring has detected elevated error rates impacting Dashboard performance. A subset of users may experience degraded responsiveness or issues loading site environments. Live hosted sites and uptime remain fully operational and unaffected. Our Engineering team is actively investigating the issue to restore full functionality as quickly as possible. Need Immediate Assistance? General concerns: Submit a ticket or reach out via Live Chat. - If the Dashboard is inaccessible: Contact us directly at [email protected]. - We will provide another update within 30–60 minutes, or as soon as new information becomes available. Thank you for your patience.

We are continuing to investigate this issue. We have also received reports of degraded performance impacting Terminus Operations, which our Engineering team is now looking into alongside the Dashboard and Workflow issues. Live hosted sites and uptime remain fully operational and unaffected. We will provide another update as soon as more information becomes available.

Our Engineering team has identified the root cause of the degraded performance impacting the Dashboard, Workflow, and Terminus Operations. We are currently running a necessary backend process to resolve the issue, which will take some time to complete. Live hosted sites and uptime remain fully operational and unaffected. We will provide our next update in 2 to 3 hours, or sooner if the situation changes.

We are still working through the necessary backend process to resolve this issue, which is expected to take some additional time. Live sites remain fully operational and unaffected. We'll provide our next update in 3 hours, or sooner if the situation changes.

Our engineering team is actively working to resolve this issue and continues to make progress. Live sites remain fully operational and remain unaffected. We'll provide our next update in 3 hours, or sooner if there are any significant developments.

Our engineering team continues to make progress toward resolving the issue. Live sites remain fully operational and are not affected. We appreciate your patience while we restore full dashboard functionality. Our next update will be provided within 3 hours, or sooner if additional information becomes available.

Our engineering team continues to work through the necessary backend processes to resolve the issue. This work is progressing as expected, and live sites remain fully operational and are not affected. Our next update will be provided within 4–5 hours, or sooner if significant new information becomes available.

Our engineering team continues to work through the necessary backend processes to resolve the degraded performance. This work remains ongoing as expected. Live hosted sites and uptime are fully operational and are not affected. We will provide our next update within 4 to 5 hours, or sooner if significant new information becomes available.

The necessary backend processes are still actively running to resolve the degraded performance. Our engineering team is continuing to monitor the progress. Live hosted sites and uptime remain fully operational and are not affected. We will provide our next update within 4 to 5 hours, or sooner if significant new information becomes available.

Our engineering team continues to make progress toward resolving the issue. Live hosted sites remain fully operational and are not affected. Our next update will be provided within 4–5 hours, or sooner if significant new information becomes available.

A fix has been implemented and we are monitoring the results.

This incident has been resolved, and full performance has been restored to the Dashboard, Workflow Operations, and Terminus Operations. Live hosted sites and uptime remained fully operational throughout this event. Thank you for your patience while we worked to resolve this. If you encounter any further issues, please contact our Support team.