EOL NumPy Security Patches — Versions 1.15.4 & 1.16.0

Check the status of CVEs. Learn More.

 CVE Status (opens in new tab)

php2shell patches (CVE-2026-109618 and CVE-2026-109619) for EOL PHP are out now. With sales replies slower than usual due to high demand, the fastest route to patched packages is to buy ELS for Runtimes online (opens in new tab). Read the patch FAQ

TuxCare keeps you ahead of threats by proactively tracking and patching new CVEs impacting NumPy. View all security fixes available to date here.

Keep Running.
Skip the Risks.

Upgrading end-of-life NumPy can be disruptive, resource-intensive, and costly.

TuxCare’s ELS keeps your legacy and EOL components secure, compliant, and stable – without the risks of costly upgrades.

Trusted by
Innovators
Around the World

What Does Endless Lifecycle Support Include?

Rapid CVE Response

Rapid SLA-backed security patches for NumPy for as long as you need

Complete Coverage

Security fixes for both direct and transitive dependencies in NumPy AT NO EXTRA COST

Preserved Compatibility

Extensively tested updates designed to work flawlessly with your existing code

Seamless Integration

Plug-and-play integration with your existing workflows and CI/CD pipelines

Secure Distribution

Signed, tamper-proof NumPy security updates delivered from trusted, TuxCare-hosted repositories

Trusted Support

24/7 expert assistance with NumPy vulnerability triage, security patch requests, and troubleshooting

Secure Every Layer of Your OSS
Dependency Tree for the Long Run

End-of-life risk rarely lives in your top-level packages. It hides in the transitive
dependencies woven throughout your open-source stack.

When one of those libraries becomes vulnerable, every downstream component
must be rebuilt and validated.

TuxCare automates this entire process – tracking vulnerable EOL
libraries, applying security fixes, and rebuilding dependent components
– ensuring your full dependency chain stays secure and stable.

How Does It Work?

1

We onboard new projects and enable 24/7 automated CVE tracking – monitoring the NVD, vendor, and GitHub security advisories, and other sources.

2

Once CVEs are detected, we backport upstream fixes using algorithmic and AI-assisted automation, with expert validation to ensure accuracy.

3

Patches are compiled in a binary format, extensively tested (for integrity, functionality, and regression), signed, and deployed to ELS repositories.

4

Your package managers, build tools, or orchestrators check for updates, then automatically pull and install them.

Learn More

Trusted Software Supply Chain

With Endless Lifecycle Support, every release is transparent,
secure, and built to industry standards you can trust.

Software Bill of Materials (SBOM)

Gain complete visibility into the components in each patched release so you always know exactly what is running in your environment.

Vulnerability Exploitability eXchange (VEX) Context

See which vulnerabilities in your SBOM have already been remediated, allowing you to focus attention where action is still required.

SLSA Level 3 Compliance*

Get packages that meet SLSA Level 3 requirements, giving you verifiable assurance of secure sourcing, building, and integrity. * Coming soon

Built for Your Stack

ELS for NumPy is built to install easily and run with your existing workflows

TuxCare has successfully resolved

more than 14,000 CVEs

in open-source software - keeping enterprise
systems secure and compliant

Check It Out

Need Coverage for Other End-of-Life
Open-Source Components?

TuxCare’s ELS extends security patching to your operating systems, runtimes,
libraries and production apps, keeping your entire open-source stack secure, stable,
and compatible for as long as you need.

Endless Lifecycle Support
for Operating Systems

Keep your legacy Linux servers patched and compliant – no risky rebuilds, downtime, hardware upgrades, or added workload.

Learn more

Endless Lifecycle Support
for Runtimes

Keep your apps running safely on the runtimes they were built for, without rushed upgrades or broken code – even after official support ends.

Learn more

Endless Lifecycle Support
for Libraries

Keep securely running your apps on EOL libraries – without rushed upgrades, costly code rewrites, or disruption to your roadmap.

Learn more

Endless Lifecycle Support
for Applications

Ensure your EOL apps stay secure and operational while avoiding outages, broken workflows, and code rewrites.

Learn more

We’ve Been Powering Enterprise-Grade Patching At
Unprecedented Scale – and We're Just Getting Started

2,700+
Enterprise Clients

70,000+Packages Curated

420,000+
Patches Delivered

14,000+
Vulnerabilities Fixed

11,000+
Kernels Supported

70+
Linux Distro Versions Supported

Why TuxCare?

15 years of proven excellence in open-source patching have created highly
automated processes and systems, providing:

Extensive Coverage of Open-Source Technologies

We provide long-term security across your entire stack, supporting a wide and continually expanding set of open-source projects, libraries, and runtimes – all from a single, trusted partner.

Efficiencies in Build Chains and Testing

We utilize advanced automation across CVE discovery, backporting, building, and release workflows to accelerate delivery and ensure the highest possible quality of security patches.

Identification and Patching of Transitive Dependencies

We go beyond surface-level scanning to uncover and fix hidden vulnerabilities deep in your dependency trees, securing the entire software supply chain with precision and scale.

Fast and Consistent Delivery of Patches with Supporting SLAs

Automated pipelines and mature workflows ensure rapid, reliable patch delivery backed by SLAs – giving you confidence in your risk management and compliance posture.

Frequently Asked Questions

No. NumPy follows the scientific Python community's rolling support policy, which drops older Python and NumPy versions on a schedule. There's no LTS branch and no backport program — once a release is superseded, it's finished. ELS for NumPy adds a defined security lifecycle to versions upstream no longer touches.

Because NumPy sits at the bottom of the stack. Its C API and ABI change between versions, and NumPy 2.0 broke a large number of downstream packages. SciPy, pandas, scikit-learn, PyTorch, and TensorFlow all pin NumPy ranges, so one bump can mean rebuilding an entire environment.

NumPy 1.15.4, 1.16.0, and 1.21.0. Other versions are available on request.

Through pip. Point index-url at TuxCare's els_python repository to draw everything from ELS, or add it as an extra-index-url and pin the patched build explicitly — for example numpy==1.21.0.post1+tuxcare. With the extra-index approach, always pin the exact version or pip may resolve to public PyPI.

Yes. Patches are backported within the same version, so the C API and ABI are preserved and compiled extensions built against your current NumPy keep working. Numerical workloads and compiled dependencies are still worth testing before rollout.

Transitive dependencies of covered packages are included at no extra cost, and TuxCare's ELS for Libraries catalogue also covers Django, Flask, FastAPI, Celery, Starlette, and Werkzeug from the same repository. Send your lockfile or SBOM for a coverage review — packages are added on request.

Talk to a TuxCare Expert

Tell us your challenges, and our experts will help you find the best approach to address them with the TuxCare product line.

Ask Us a Question