Everpatch: Extended Lifecycle Support for EOL Linux
Your OS reached end of life. Your infrastructure didn't. Everpatch keeps it viable.
A maintained modern kernel, security-patched EOL PHP runtimes, and current PHP for CentOS 7 — signed RPMs from the GetPageSpeed repository, built by the people who package NGINX for 100,000+ servers.
What Everpatch covers
Everpatch Kernel
The current 6.18.x LTS kernel from kernel.org, packaged and signed for EL7. kdump works out of the box. Formerly known as CoreCare.
Everpatch Kernel →Everpatch PHP
Security-patched builds of EOL PHP lines for CentOS 7 — the fixes upstream and Remi no longer ship for EL7, ported and audited:
PHP 5.6 · PHP 7.0 · PHP 7.3 · PHP 7.4 · PHP 8.0 · PHP 8.1
Need current PHP instead? PHP 8.4 for CentOS 7 →CentOS 7, end to end
The whole extended-lifecycle picture for EL7 fleets: kernel, PHP, container base images, and what is (and isn't) covered.
CentOS 7 Extended Lifecycle Support →How Everpatch works
- Upstream fixes, ported and audited. Security patches are taken from upstream and the maintained vendor branches, ported to the EOL codebase, and audited hunk by hunk. Every release documents each patch's provenance.
- Same package names, in-place upgrades. Everpatch packages carry the names your system already uses, so
yum upgradeswaps them in andyum downgradereverts. - Signed and served like everything else we ship. One GPG key, one repository —
extras.getpagespeed.com— alongside the NGINX packages GetPageSpeed is known for. - No agents, no license files, no lock-in. They are RPMs. Remove the repo and you are back where you were.
What's coming
Signal of direction, not a roadmap with dates:
- More runtimes. Python lines that distributions abandoned are next in the queue.
- More distributions. Older Ubuntu LTS releases as their maintenance cliffs arrive.
- Free userspace security packages. Extending the free line beyond the kernel (openssl, glibc, curl and the usual CVE magnets) where fixes backport cleanly.
Frequently asked questions
What exactly is Everpatch?
GetPageSpeed's extended-lifecycle product line: signed packages that keep end-of-life Linux systems viable. Today that means a maintained modern kernel for EL7 (free), security-patched EOL PHP runtimes, and a current PHP 8.4 stack for CentOS 7 — all served from the same extras.getpagespeed.com repository as the rest of our packages.
Is this the same thing as TuxCare ELS?
Same problem space — keeping EOL systems patched — different shape. TuxCare sells per-server extended-lifecycle contracts with account managers and SLAs. Everpatch ships signed RPMs from a public repository: the kernel is free, and the PHP channels are open today. If you need contractual SLAs and procurement paperwork, TuxCare is built for that.
Do I need a subscription?
The Everpatch Kernel is free, full stop. The PHP channels are currently served from the public repository. GetPageSpeed subscriptions fund this work and add the commercial extras — Pro NGINX modules, license tokens, repo mirroring, and priority support.
Which distributions are covered?
EL7 (CentOS 7 / RHEL 7) first, because its gap is the biggest: a maintained kernel, six security-patched EOL PHP lines, and current PHP 8.4. More runtimes (Python is on the roadmap) and more distributions (older Ubuntu LTS releases) follow as their vendor-maintenance cliffs arrive.
Why keep an EOL system running at all?
Because real production migrations take quarters, not weekends — and a scheduled migration is not a reason to run known-vulnerable software in the meantime. Everpatch keeps the known holes closed so the migration happens on your timeline instead of a CVE's.