Security support for end-of-life Linux
When a distribution reaches end of life, every package on the server freezes: the kernel, OpenSSH, OpenSSL, glibc, sudo. New vulnerabilities keep coming, the fixes stop. We backport the security fixes to the versions you run, so the server keeps working while you plan the move.
Request a server assessmentLinux distributions past end of life
| Distribution | End of life | Kernel | OpenSSH | OpenSSL | glibc | Forkward |
|---|---|---|---|---|---|---|
| CentOS 7 | 30 June 2024 | 3.10 | 7.4p1 | 1.0.2k | 2.17 | Patch on order, 48 h |
| RHEL 7 | 30 June 2024 | 3.10 | 7.4p1 | 1.0.2k | 2.17 | Patch on order, 48 h |
| Oracle Linux 7 | 31 December 2024 | 3.10 | 7.4p1 | 1.0.2k | 2.17 | Patch on order, 48 h |
| CentOS 6 | 30 November 2020 | 2.6.32 | 5.3p1 | 1.0.1e | 2.12 | Patch on order, 48 h |
| CentOS 8 | 31 December 2021 | 4.18 | 8.0p1 | 1.1.1k | 2.28 | Patch on order, 48 h |
| Amazon Linux 2 | 30 June 2026 | 4.14 | 7.4p1 | 1.0.2k | 2.26 | Patch on order, 48 h |
| Ubuntu 16.04 | 2 April 2021 | 4.4 | 7.2p2 | 1.0.2g | 2.23 | Patch on order, 48 h |
| Ubuntu 18.04 | 31 May 2023 | 4.15 | 7.6p1 | 1.1.1 | 2.27 | Patch on order, 48 h |
| Ubuntu 20.04 | 31 May 2025 | 5.4 | 8.2p1 | 1.1.1f | 2.31 | Patch on order, 48 h |
| Debian 10 | 30 June 2024 | 4.19 | 7.9p1 | 1.1.1n | 2.28 | Patch on order, 48 h |
| Debian 11 | 31 August 2026 | 5.10 | 8.4p1 | 1.1.1w | 2.31 | Patch on order, 48 h |
End of standard support from the vendors, via endoflife.date. Package versions from each distribution's public repositories, 28 October 2026. RHEL 7 and Oracle Linux 7 ship the same versions as CentOS 7.
What is inside
Linux kernel
The most exploited open-source component. The kernel series each distribution ships, with their known and exploited flaws.
OpenSSH
The SSH server on every machine. regreSSHion, Terrapin and every other known flaw, for each version in use.
OpenSSL
1.0.2, 1.1.1 and 3.0 are all past end of life. The versions distributions ship, and what affects them.
PHP
PHP 5.3 to 8.0 on old distributions, with PHP2Shell status and every known vulnerability.
NIS2 and DORA
Both expect you to handle known vulnerabilities. Our fixes and their public status give your auditor an answer for every old system you keep. What each law asks
Patch on order, 48 h
We backport the fix to the version you run within 48 hours of your order, or within 24 hours with priority delivery. See the plans