Jan 16, 12:28 PST
Resolved – Drupal.org has released Drupal version 8.6.6. This release is classified as a security release for all previous versions of Drupal. Pantheon has made the update available for one-click update in site dashboards. We urge all users to update all environments as soon as possible. Instructions for applying core updates can be found in our Support Center. This release addresses SA-CORE-2019-002; all users are urged to upgrade their sites as soon as possible.
 – https://www.drupal.org/project/drupal/releases/8.6.6
 – https://pantheon.io/docs/upstream-updates/
 – https://www.drupal.org/sa-core-2019-002