The ActiveState Alternative That Keeps Patching After Upstream Stops - TuxCare

Check the status of CVEs. Learn More.

 CVE Status (opens in new tab)

php2shell patches (CVE-2026-109618 and CVE-2026-109619) for EOL PHP are out now. With sales replies slower than usual due to high demand, the fastest route to patched packages is to buy ELS for Runtimes online (opens in new tab). Read the patch FAQ

How the Two Catalogs Compare

Feature
SecureChain
ActiveState
Catalog model ✓One shared catalog of pre-vetted packages, rebuilt from source ✓A private catalog for each customer, drawn from ActiveState's library and rebuilt from source
SLSA provenance ✓Level 3 ✓Level 3
SBOM and VEX ✓Included ✓Included
CVE remediation SLA ✓Published for every severity, and the clock runs whether or not upstream has a fix ⚠Advertised at 5, 10, and 30 business days, starting once an upstream fix exists
Who writes the fix? ✓Upstream, fixes plus our own patches, on the version you run ✗Upstream-dependent
End of life (EOL) patching ✓Continues under Endless Lifecycle Support, on the exact versions you run ⚠Coverage ends at end of life; a custom agreement is required after that
EOL remediation SLA ✓Yes, measured from CVE disclosure ✗None published
Versions dropped without notice ✓Patched on a published SLA, no EOL announcement needed ✗None published
Malware defense ✓Source code inspected at intake for hidden malicious behavior and suspicious patterns, not just known signatures ⚠No published method; no word on whether source code is inspected
On-demand packages ✓Most packages are already in the catalog; anything missing is added at no extra cost ⚠Catalog contents are chosen per customer, and every missing component is a wait

Patches Shouldn't Stop Because Upstream Did

Older releases rarely get a farewell notice. Upstream just moves on. SecureChain keeps patching the version you run, on a published SLA, so an aging dependency doesn't turn into a surprise migration project.

Ask Us a Question
SecureChain

Three Differences You Feel in Production

Pull vetted packages from day one

SecureChain ships with thousands of packages per ecosystem already vetted, so the common dependencies are there before anyone files a request. ActiveState catalogs are assembled per customer.

Keep getting patches after upstream stops

Plenty of open source libraries never announce an end of life. They just stop shipping fixes. SecureChain notices and keeps patching. ActiveState covers them under a separate agreement, if you ask.

Catch what nobody has flagged yet

A clean CVE record doesn't make a package safe. SecureChain scans the source of every package at intake for hidden malware. ActiveState doesn't document how its malware checks work.

We’ve Been Powering Enterprise-Grade Patching At
Unprecedented Scale – and We're Just Getting Started

2,700+
Enterprise Clients

14,000+
Vulnerabilities Fixed

420,000+
Patches Delivered

70,000+Packages Curated

Switch Without Rebuilding Your Pipeline

  • Move from your ActiveState catalog to TuxCare builds of the versions you already run, with a one-time setup per repository.

  • Keep your package managers and install commands. Every package comes with SLSA Level 3 provenance, an SBOM, and VEX.

Get Your Packages Today and Your Patches on Time

Send over the packages and versions your team depends on. We'll show you what's already in the catalog and where TuxCare takes over when upstream stops.

Ask Us a Question