Tech Support
Documentation
Login
Contact Us
Technology Partnerships
Add the open source security coverage your platform should not have to build itself
TuxCare gives technology vendors and open source projects a ready-made security layer for the parts of open source that are hardest to maintain. We rebuild packages from verified source, patch them for as long as your customers run them, and keep going after upstream stops. You keep the customer experience while we supply the security work underneath it.
Endless Lifecycle
Support
KernelCare
1.233 million+ malicious packages
identified across public
open source ecosystems
Source: Sonatype, 2026 State of the Software Supply Chain
93% of audited codebases still carry
open source nobody has
touched in over two years
Source: Black Duck, 2026 Open Source Security and Risk Analysis
1,596 verified vulnerabilities found
by one AI model in 63 days,
with fixes landing at ~1.5 a day
Source: Tuskira, The Emerging Patch Gap
Three ways partners use TuxCare
Open source causes trouble in three places. It gets into a build before anyone has checked it, it turns out to be vulnerable in a version nobody can upgrade off, or it outlives the people maintaining it. Partners plug TuxCare in at whichever of those their product already touches.
1 Curation and Repository Platforms
Point your customers at a source
that stays safe after they adopt it
When your curation engines and package firewalls block a package, give developers somewhere safe to go. TuxCare supplies that alternative: the same packages, rebuilt from verified source with provenance and security metadata attached, maintained while upstream is active and after it stops.
Source: SecureChain covers JavaScript, Python, Java, Go, Rust, and PHP.
Rollout runs ecosystem by ecosystem, so one or more may still be in pre-launch.
Check current status with [email protected] before scoping.
JavaScript
Python
Java
Go
Rust
PHP
Who is this for?
- Artifact repositories and registries
- Package curation and policy engines
- Package firewalls
- Developer platforms that distribute open source packages
What you get with TuxCare
- Source-rebuilt open source
packages with verifiable
provenance - SBOM and VEX data
your policy engine can
act on - SLA-backed CVE
remediation across the
package lifecycle - Continued maintenance
after upstream
support ends
Partners doing this today
JFrog
SecureChain packages flow into JFrog’s remediation workflow, where a vulnerable artifact is matched to a maintained replacement and the action can be attested through JFrog AppTrust.
Partner link: JFrog
2 Security and Remediation Platforms
Give every finding a fix your customers
can apply without an upgrade
Detection is the mature half of this market. Remediation still ends at an upgrade plenty of customers cannot take this quarter or at all, which is where a finding turns into a ticket nobody closes. TuxCare supplies a patched build of the version already in production, from actively maintained packages through to end-of-life runtimes and the running Linux kernel.
Who is this for?
- Software composition analysis and application security platforms
- Container security products
- Vulnerability management
- Patch management
- Infrastructure and lifecycle management platforms
What you get with TuxCare
- Backported CVE fixes for
versions customers cannot
replace yet - Drop-in maintained
packages for end-of-life
dependencies - Rebootless Linux kernel
patching for production
systems - Patch-state data so your
product can tell a fixed
CVE from an open one
Partners doing this today
Application Security
JFrog Xray
When Xray identifies a vulnerable open source component, TuxCare can supply a maintained package for the version line already in use, keeping remediation inside the JFrog workflow.
Aikido Security
Aikido AutoFix offers TuxCare ELS packages as drop-in replacements for vulnerable end-of-life dependencies, so the fix arrives as a pull request instead of a major-version project.
Vulnerability, Patch, and Lifecycle Management
Ivanti
KernelCare adds rebootless Linux kernel remediation to established patch operations, so critical kernel fixes do not have to wait for the next maintenance reboot.
orcharhino
The KernelCare plug-in brings rebootless kernel patching into the orcharhino workflow, with job templates for checking patch state and applying updates across managed hosts.
Foreman
KernelCare job templates let Foreman-managed environments install KernelCare, inspect patched kernel state, and run rebootless kernel updates alongside other host operations.
3 Open Source Projects and Foundations
Keep old branches secure without putting
them back on the maintainer’s plate
Users keep filing issues asking for patches on branches the project closed years ago, and the honest answer costs maintainer time nobody has. TuxCare backports security fixes to agreed end-of-life versions through Endless Lifecycle Support and, as a CVE Numbering Authority, carries disclosure through to the CVE record.
Who is this for?
- Maintainers of widely used libraries
- Frameworks, and applications
- Open source foundations
- Companies stewarding projects with long-lived production users
What you get with TuxCare
- Security maintenance for
agreed end-of-life
branches - Backported fixes built to
preserve compatibility - Vulnerability research,
triage, and coordinated
disclosure - A commercial support path
for users who need more
time before upgrading
Partners doing this today
Webtide
Webtide users running end-of-life Jetty or CometD releases can take TuxCare lifecycle coverage alongside Webtide support, instead of pushing old-branch maintenance back onto the project team.
Partner link: Webtide
OpenJS Foundation
TuxCare supports the OpenJS Ecosystem Sustainability Program, keeping security fixes available to organizations that still run unsupported versions of participating JavaScript projects.
Partner link: OpenJS Foundation
Commonhaus Foundation
As part of Commonhaus sustainability work, TuxCare gives users of supported end-of-life project versions a security path while maintainers stay focused on current releases.
Partner link: Commonhaus
A shared customer asked for TuxCare interoperability? Start here.
No partnership to design, just a customer whose systems your product is reading wrong. If they run KernelCare or ELS, we supply the patch-state data, test licenses, and an engineering contact to sort it out.
Request interoperability
The work behind the integration
- 420,000+ patches delivered
- 70,000+ packages curated
- 11,000+ kernels supported
- 2,700+ enterprise customers
Fifteen years of open source patching sits behind every integration on this page. Packages are rebuilt from verified source with security metadata attached, patched against published response-time SLAs, and tracked through to a public CVE record. Our partners get the artifacts, the metadata, and the evidence trail.
Your customers already have the workflow.
Add the missing security layer.
If your product can identify, govern, distribute, or manage open source, TuxCare can extend what happens after that point. From us, you get a trusted package to serve, a maintained fix to apply, or coverage for software upstream has left behind.
Scope an Integration