Keep old PHP versions patched. Leave customer code alone.
Endless Lifecycle Support (ELS) for PHP backports security fixes to PHP 5.2 through 8.5, so customers’ sites stay patched on their original PHP version.
When a PHP version reaches end of life
A PHP version at end of life keeps running every site built on it, exactly as before. The difference shows the next time a vulnerability turns up.
Security fixes stop
The PHP project patches each version for three to four years. After that, new vulnerabilities stay open on it, however serious they are.
Nearly half of PHP sites
Nearly half of PHP websites run a version that the PHP project no longer patches, according to W3Techs (October 2026).
One flaw, every site
On a shared server, one PHP version runs dozens or hundreds of sites. A vulnerability in that version exposes every site on it.
The code belongs to your customers
The textbook answer is an upgrade. But your customers’ sites aren’t yours to rewrite.
TuxCare, our sister company that builds ELS for PHP, estimates that moving from PHP 5.x to PHP 8 can mean rewriting up to 60% of a site’s code. So the upgrade turns into an email asking every customer on that version to fund a project they didn’t plan. Some pay for the rewrite, and some move to another host.
With ELS for PHP, the version stays patched and each customer upgrades when they’re ready.
Without ELS
Upgrade notice to every customer
With ELS
Same PHP, patched
The PHP project shipped fixes for 4 versions. ELS for PHP fixed 16.
PHP2Shell (CVE-2026-109618 and CVE-2026-109619) was a pair of critical flaws that let an attacker run code on a server without logging in. On October 21, the PHP project released fixes for PHP 8.2 to 8.5. Sites on 8.1 and older got no release. ELS for PHP had fixes for every version from 5.2 to 8.5 the same day.
What you get with ELS for PHP
Patched after end of life
Security fixes keep coming for PHP 5.2 through 8.5, including the versions the PHP project has stopped patching.
Same version, same code
A patched build keeps its PHP version, so each site runs on the same PHP it was built for, with its code untouched.
Move sites at your own pace
The patched builds install alongside your system PHP, cPanel’s ea-php or Plesk’s PHP, and sites move over one account at a time.
One license per server
One license covers every PHP version on the server and every site it hosts. Add versions as customers need them.
How ELS for PHP works
Track
TuxCare monitors new PHP vulnerabilities through vendor advisories, the National Vulnerability Database and its own research.
Backport
TuxCare backports each fix to the affected PHP versions and tests it for functionality and regressions.
Sign and publish
TuxCare signs the packages and publishes them to the ELS repository for your operating system.
Switch sites over
Your package manager installs the builds, and you switch each account to them.
Built for your stack
The PHP versions available vary by system. See the full table.
Already running CloudLinux or Imunify360? Both include these patched builds as HardenedPHP, at no extra cost.
One price per server
Pay monthly or yearly. Your license key arrives by email as soon as you buy.
- Every PHP version on the server, from 5.2 to 8.5
- Every site the server hosts
- 24/7 support from CloudLinux
Already have a CloudLinux Network account? Buy ELS for PHP there.
Common questions from hosting providers and agencies
No. It installs patched builds next to your current PHP, each under its own path. Sites keep running on the old PHP until you switch them. To roll back, switch the site back.
Keep sites on the PHP they were built for, patched
Your customers upgrade when they’re ready, and their PHP gets security fixes until then.