MinIO End-of-Life Security Patches

Check the status of CVEs. Learn More.

 CVE Status (opens in new tab)

php2shell patches (CVE-2026-109618 and CVE-2026-109619) for EOL PHP are out now. With sales replies slower than usual due to high demand, the fastest route to patched packages is to buy ELS for Runtimes online (opens in new tab). Read the patch FAQ

On February 13, 2026, the MinIO open-source project was archived.

  • No more releases.
  • No more bug fixes.
  • No more security patches.
  • The repository is frozen.

Every CVE disclosed from this date forward – in MinIO itself or in any of its Go dependencies – will remain unpatched upstream, indefinitely.

MinIO archived

Keep Running.
Skip the Risks.

Migrating off an archived MinIO deployment is disruptive, resource-intensive, and expensive at petabyte scale.

TuxCare's ELS keeps your current MinIO deployment secure, compliant, and stable — without the risks of a forced migration or commercial re-licensing.

Your options after the archive

Option What it means Trade-off
Migrate to MinIO AIStor
Commercial fork from MinIO Inc.
High entry price, capacity-based licensing, full vendor lock-in
Self-maintain or fork
Backport patches in-house
Requires sustained Go security engineering capacity; most teams can’t staff it
Endless Lifecycle Support
TuxCare ELS for MinIO
Ongoing CVE patches for the archived open-source version
Ongoing subscription costs, allowing you to keep what you’re running

Secure Every Layer of Your MinIO
Dependency Tree for the Long Run

TuxCare tracks CVEs across MinIO's entire dependency graph, applies security fixes, and rebuilds
dependent components – ensuring your full dependency chain stays secure and stable.

How Does It Work?

1

We onboard new projects and enable 24/7 automated CVE tracking – monitoring the NVD, vendor, and GitHub security advisories, and other sources.

2

Once CVEs are detected, we backport upstream fixes using algorithmic and AI-assisted automation, with expert validation to ensure accuracy.

3

Patches are compiled in a binary format, extensively tested (for integrity, functionality, and regression), signed, and deployed to ELS repositories.

4

Your package managers, build tools, or orchestrators check for updates, then automatically pull and install them.

Learn More

Built for Your Stack

ELS for MinIO is built to install easily and run with your existing workflows

TuxCare has successfully resolved

more than 14,000 CVEs

in open-source software - keeping enterprise
systems secure and compliant

Check It Out

Why TuxCare?

15 years of proven excellence in open-source patching have created highly
automated processes and systems, providing:

Extensive Coverage of Open-Source Technologies

We provide long-term security across your entire stack, supporting a wide and continually expanding set of open-source projects, libraries, and runtimes – all from a single, trusted partner.

Efficiencies in Build Chains and Testing

We utilize advanced automation across CVE discovery, backporting, building, and release workflows to accelerate delivery and ensure the highest possible quality of security patches.

Identification and Patching of Transitive Dependencies

We go beyond surface-level scanning to uncover and fix hidden vulnerabilities deep in your dependency trees, securing the entire software supply chain with precision and scale.

Fast and Consistent Delivery of Patches with Supporting SLAs

Automated pipelines and mature workflows ensure rapid, reliable patch delivery backed by SLAs – giving you confidence in your risk management and compliance posture.

Talk to a TuxCare Expert

Tell us your challenges, and our experts will help you find the best approach to address them with the TuxCare product line.

Ask Us a Question