Endless Lifecycle Support for Open-Source Software
close

php2shell patches (CVE-2026-109618 and CVE-2026-109619) for EOL PHP are out now. With sales replies slower than usual due to high demand, the fastest route to patched packages is to buy ELS for Runtimes online (opens in new tab). Read the patch FAQ

Extensive Coverage of
Open-Source Technologies

  • BERJAYA
  • BERJAYA
  • BERJAYA
  • BERJAYA
  • BERJAYA
  • BERJAYA
  • BERJAYA
  • BERJAYA
  • BERJAYA
  • BERJAYA
  • BERJAYA
  • BERJAYA
  • BERJAYA
  • BERJAYA
  • BERJAYA
  • BERJAYA
  • BERJAYA
  • BERJAYA
  • BERJAYA
  • BERJAYA
  • BERJAYA
  • BERJAYA
  • BERJAYA
  • BERJAYA
  • BERJAYA
  • BERJAYA
  • BERJAYA
  • BERJAYA
  • BERJAYA
  • BERJAYA
  • BERJAYA
  • BERJAYA
  • BERJAYA
  • BERJAYA
  • BERJAYA
  • BERJAYA
  • BERJAYA
  • BERJAYA
  • BERJAYA
  • BERJAYA
  • BERJAYA
  • BERJAYA
  • BERJAYA
  • BERJAYA
  • BERJAYA
  • BERJAYA
  • BERJAYA
  • BERJAYA
  • BERJAYA
  • BERJAYA
  • BERJAYA
  • BERJAYA
  • BERJAYA
  • BERJAYA
  • BERJAYA
  • BERJAYA
  • BERJAYA
  • BERJAYA
  • BERJAYA
  • BERJAYA
  • BERJAYA
  • BERJAYA
  • BERJAYA
  • BERJAYA
  • BERJAYA
  • BERJAYA
  • BERJAYA
  • BERJAYA

Keep Your Entire Open-Source Stack Secure, Compatible,
and Compliant - for as Long as You Need It

From the Core OS to Production Apps, TuxCare Has You Covered

BERJAYA

Explore TuxCare’s Endless Lifecycle Support Portfolio

BERJAYA

Endless Lifecycle Support
for Operating Systems

Keep your legacy Linux servers patched and compliant – no risky rebuilds, downtime, hardware upgrades, or added workload.

Learn more

BERJAYA

Endless Lifecycle Support
for Runtimes

Keep your apps running safely on the runtimes they were built for, without rushed upgrades or broken code – even after official support ends.

Learn more

BERJAYA

Endless Lifecycle Support
for Libraries

Keep securely running your apps on EOL libraries – without rushed upgrades, costly code rewrites, or disruption to your roadmap.

Learn more

BERJAYA

Endless Lifecycle Support
for Applications

Ensure your EOL apps stay secure and operational while avoiding outages, broken workflows, and code rewrites.

Learn more

If It's Open Source
and Not on Our List,

We're Ready to
Support It. Just Ask.

BERJAYA

Trusted by
Innovators
Around the World

  • BERJAYA
  • BERJAYA
  • BERJAYA
  • BERJAYA
  • BERJAYA
  • BERJAYA
  • BERJAYA
  • BERJAYA
  • BERJAYA
BERJAYA

TuxCare has successfully resolved

more than 14,000 CVEs

in open-source software - keeping enterprise
systems secure and compliant

Check It Out
BERJAYA

What Is Included in Endless Lifecycle Support?

BERJAYA

Rapid CVE Response

Rapid SLA-backed security patches
for as long as you need

Cybercriminals actively exploit newly discovered flaws – especially in unsupported systems. With guaranteed timelines and rapid patch delivery, TuxCare keeps your infrastructure protected and ahead of evolving threats.

BERJAYA

Complete Coverage

Security fixes for both direct and transitive
dependencies AT NO EXTRA COST

Fixing the parent package doesn’t automatically address risks hidden in its dependencies, leaving multiple layers vulnerable. ELS protects you at every level, covering both direct and transitive dependencies without added cost.

BERJAYA

Secure Delivery

Get patches quickly and securely –
no extra tooling is needed

All ELS updates are delivered through secure, TuxCare-hosted repositories, ensuring verified, tamper-proof delivery directly to your systems. Packages are signed and built to enterprise standards so that you can trust every update.

BERJAYA

Seamless Integration

ELS packages fit right
into your existing workflows

TuxCare’s ELS packages plug into your existing workflows and CI/CD pipelines, with full support for yum, apt, pip, Maven, Gradle, npm and others. Updates flow through your current toolchain without disruptions and process changes.

BERJAYA

Support You Can Trust

Around-the-clock expertise
whenever you need it

TuxCare’s global support team is available 24/7/365 to provide responsive assistance with:

  • CVE reporting and prioritization
  • Patch requests
  • Integration support
  • Break/fix troubleshooting

How Does It Work?

BERJAYA
1

We onboard new projects and enable 24/7 automated CVE tracking – monitoring the NVD, vendor, and GitHub security advisories, and other sources.

BERJAYA
2

Once CVEs are detected, we backport upstream fixes using algorithmic and AI-assisted automation, with expert validation to ensure accuracy.

BERJAYA
3

Patches are compiled in a binary format, extensively tested (for integrity, functionality, and regression), signed, and deployed to ELS repositories.

BERJAYA
4

Your package managers, build tools, or orchestrators check for updates, then automatically pull and install them.

Our Customers
Trust Us

BERJAYA

“TuxCare’s Endless Lifecycle Support gives us long-term security without costly upgrades

It’s extremely easy to implement and reduces the effort of securing our older software releases, while providing greater predictability and flexibility in our release planning.”

BERJAYA
Jan Harder

Head of Product Development, encoway GmbH

We’ve Been Powering Enterprise-Grade Patching At
Unprecedented Scale – and We're Just Getting Started

BERJAYA

2,700+
Enterprise Clients

BERJAYA

70,000+Packages Curated

BERJAYA

420,000+
Patches Delivered

BERJAYA

14,000+
Vulnerabilities Fixed

BERJAYA

11,000+
Kernels Supported

BERJAYA

70+
Linux Distro Versions Supported

Why TuxCare?

15 years of proven excellence in open-source patching have created highly
automated processes and systems, providing:

Extensive Coverage of Open-Source Technologies

We provide long-term security across your entire stack, supporting a wide and continually expanding set of open-source projects, libraries, and runtimes – all from a single, trusted partner.

Efficiencies in Build Chains and Testing

We utilize advanced automation across CVE discovery, backporting, building, and release workflows to accelerate delivery and ensure the highest possible quality of security patches.

Identification and Patching of Transitive Dependencies

We go beyond surface-level scanning to uncover and fix hidden vulnerabilities deep in your dependency trees, securing the entire software supply chain with precision and scale.

Fast and Consistent Delivery of Patches with Supporting SLAs

Automated pipelines and mature workflows ensure rapid, reliable patch delivery backed by SLAs – giving you confidence in your risk management and compliance posture.

Frequently Asked Questions

Endless Lifecycle Support, or ELS, is TuxCare’s extended security support for open-source software that has reached end of life. ELS delivers ongoing CVE patches for out-of-support operating systems, language runtimes, libraries, and applications, so you can keep running the versions your applications depend on without rushed migrations or disruptive upgrades.

Not without added protection. After software reaches end of life, upstream maintainers stop issuing security fixes, but new CVEs keep appearing. Attackers often target unsupported systems because they know patches are no longer coming. ELS closes that gap by continuing to patch the end-of-life version you already run for as long as you need.

Yes. ELS covers the full open-source stack, including end-of-life operating systems like CentOS 7, language runtimes, libraries, development frameworks, and applications. TuxCare is your single trusted partner that supports a broad and growing list of open-source projects, with additional coverage available on request.

As long as you need to. ELS is designed to provide security patches for out-of-support versions indefinitely, well beyond the upstream end-of-life date. That turns upgrade or migration timing into a business decision instead of a security deadline.

No. ELS exists to avoid forced upgrades. TuxCare backports security fixes into the versions you already run, so your applications can stay on the runtimes, libraries, and OS releases they were built for while you plan upgrades or migrations on your schedule.

TuxCare monitors CVEs 24/7 across trusted sources such as the NVD, vendor advisories, and GitHub security advisories. When a relevant CVE appears, TuxCare backports the fix, validates it, tests for integrity and regressions, signs the update, and publishes it through secure TuxCare repositories. Updates flow through existing package managers and build tools, including yum, apt, pip, Maven, Gradle, npm, and others.

Fifteen years of open source patching, with the track record to back it. TuxCare has fixed more than 14,000 vulnerabilities, delivered over 420,000 patches, and curates 36,000+ packages across 11,000+ kernels and 70+ Linux distribution versions for 2,700+ enterprise clients. ELS adds SLA-backed patch timelines, signed and tested package delivery, coverage for both direct and transitive dependencies, and 24/7/365 global support.

Talk to a TuxCare Expert

Tell us your challenges, and our experts will help you find the best approach to address them with the TuxCare product line.

BERJAYA