CentOS is two years dead —
extended support is the market that grew in its place.

CentOS 7 reached end of life on June 30, 2024. CentOS 8 got there first — December 31, 2021, cut short by the Stream transition. Neither has received an official patch since. And yet both still run production fleets in numbers nobody publishes and everybody recognises, which is why “CentOS extended support” is one of the most-searched lifecycle questions there is: the OS is dead, the workloads are not, and a commercial market has grown in the gap.

This guide answers the question that search actually asks: can you still buy security patches for CentOS 7 and 8 in 2026, from whom, and what does that genuinely buy you — and when is the honest answer “spend the money on the migration instead”?

Where CentOS actually stands in 2026

The dates, and how long ago they were as of publication:

Every disclosed CVE against the CentOS 7 kernel, glibc, OpenSSL or any system package since mid-2024 is permanently unfixed in the official repositories. That is not an abstract risk statement: enterprise Linux is a fixture of CISA’s Known Exploited Vulnerabilities catalog, and an unpatched el7 host is the textbook lateral-movement waypoint. It is why CentOS scores 80 on our risk scale — and why the score no longer falls.

One taxonomy note, because it changes what you are shopping for: CentOS Stream is a different product. Classic CentOS rebuilt RHEL after release; Stream sits upstream of RHEL and rolls continuously, on a much shorter lifecycle — Stream 8 died 2024-05-31, a month before CentOS 7 did. Extended-support contracts are for classic CentOS; if you are on Stream, your decision is a distribution decision, not a support-contract decision.

What extended support means for a dead distribution

Post-EOL Linux support is the most mature corner of the extended-support market, and the mechanism is consistent across vendors: CVE fixes are backported into the existing package set — same major version, same ABI, no distribution upgrade — delivered from the vendor’s repositories instead of the dead official ones. Your fleet keeps running exactly what it runs today; what changes is that disclosed vulnerabilities start getting fixed again.

What it is not: a resurrection. Coverage is typically scoped to security fixes for a defined package set — kernel and the core userland at minimum, with breadth varying meaningfully by vendor and tier. New features, new hardware enablement and non-security bug fixes are generally out. And the contract has an end date of its own, usually measured in years: the point of extended support is a bounded, patched bridge to a migration, not a way to never migrate.

The two questions that separate the offerings, and that belong in any procurement conversation: which packages are actually covered (full repo parity or a core subset?), and how fast do high-severity fixes land relative to the disclosure. Both vary; neither is knowable from a pricing page.

The market: who sells CentOS extended support

Several established vendors sell post-EOL security support for CentOS 7 — and in most cases CentOS 8 and even 6 — among them TuxCare (Extended Lifecycle Support), OpenLogic, and SUSE (Multi-Linux Support, formerly Liberty Linux), alongside migration-focused offerings from the AlmaLinux and Rocky Linux commercial ecosystems. Windows in this market run years past the official EOL date; the exact end dates are contract terms rather than published lifecycle facts, so treat them as questions for the vendor, not assumptions.

We deliberately keep this section vendor-neutral: we track the dates, and vendors do not pay for placement here. The honest comparison points are coverage scope, patch latency, compliance attestations (FIPS, FedRAMP-relevant streams if you need them) and exit terms — not logos. Our extended-support vendor guide covers how the category works and how to evaluate it.

If you want the shortcut: tell us your situation via the form on this page or the CentOS 7 decision guide and we will reply with options matched to it — free, no obligation, independent.

Extended support vs migration — the actual decision

The full decision flow lives in our CentOS 7 decision guide; the short version has held up across every estate we have looked at:

If you can migrate within your risk window, migrate. RHEL, AlmaLinux and Rocky Linux are the standard destinations, all el-family, and conversion tooling (convert2rhel and friends) covers most CentOS 7 estates without a rebuild. Money spent on extended support is bridge money; money spent on migration is exit money.

If the workload is compliance-critical or internet-facing and cannot move quickly, buy the bridge. Extended-support coverage typically begins at contract signing — days, not the weeks-to-months a migration takes. Under most audit frameworks, “unsupported OS with documented commercial security coverage and a dated migration plan” is a defensible position. An unsupported OS with neither is an open finding.

What is not a strategy is the third option most fleets are actually on: nothing. Two years past EOL, “we have not decided yet” and “we decided to accept the risk” are indistinguishable to an auditor — except the second one comes with a signature and a date, which is precisely what makes it defensible.

What to do

If you are on CentOS 7: pick the bridge or the exit this quarter — the two-year mark is past, and the compliance clock (NIS2 in Europe, audit frameworks generally) now runs faster than the technical one. Either answer is defensible; not answering is not.

If you are on CentOS 8: the same, with less sympathy from your auditor — it has been unpatched since 2021. The silver lining: el8 estates convert to AlmaLinux or Rocky more cleanly than el7 does.

If you already have an extended-support contract: diarise its end date the way you should have diarised CentOS’s — it is an EOL date too, and the migration it was meant to buy time for still needs to exist. Our EOL checker and deadline radar are built for exactly that.

Every CentOS release, its dates and its EOL Risk Score are on the CentOS lifecycle page — and the fuller history, including why CentOS 8 died early, is in our CentOS end-of-life guide.

Frequently Asked Questions