Debian 11 Has 29 Days of Patches Left — and Bullseye Runs the Boxes Nobody Remembers

Published: August 2, 2026  ·  EOL Watch — deadline coverage  ·  Dates verified against the Debian project and Freexian — methodology

Debian 11 "Bullseye" receives its last free security updates on August 31, 2026 — 29 days from this article's publication on August 2. That is the end of its Long Term Support window, and unlike most end-of-life dates, this one has no soft landing: on September 1 the Debian project publishes no further security updates for Bullseye, for any package, at any severity. The only patches after that date come from paid Extended LTS.

We already published the deadline guide — the three support tiers, the full version table, the options compared. This piece is about the harder problem the deadline exposes: the Debian 11 machines most at risk are the ones no dashboard lists. Bullseye was the stable release of 2021. The teams that deployed it deliberately have mostly moved on. What is left is the sediment — the appliance that shipped with it, the CI runner imaged in 2022, the FROM debian:bullseye line copied between Dockerfiles for five years. Those are the installs that will sail past August 31 unpatched, because nobody knows they exist.

The five-year-old install problem

Bullseye turns five years old on August 14, 2026 — seventeen days before its support ends. Five years is exactly long enough for an operating system to disappear from institutional memory. The engineer who provisioned it has changed teams or companies. The ticket that tracked it is archived. The monitoring covers the application, not the OS release underneath it.

And Debian is uniquely good at disappearing, because it is uniquely good at not breaking. A Bullseye box that has been quietly applying LTS updates since 2024 has given its owners zero reasons to look at it. That reliability is precisely what makes the August cutoff dangerous: the machines have spent years training their operators not to think about them.

Where five-year-old Bullseye installs actually live:

• Appliances and vendor VMs. Firewall managers, NAS units, badge systems, building controllers, monitoring collectors — vendors shipped enormous numbers of Bullseye-based images in 2021–2023, and the OS inside an appliance is invisible unless the vendor tells you. Many never will.
• Container base images. FROM debian:11, FROM debian:bullseye-slim, and the language images built on them from that era. The tag keeps pulling forever; the patches stop. This is the FROM-line audit problem — Bullseye is about to become its biggest example.
• CI runners and build agents. Imaged once, cloned many times, updated never. A build fleet is the classic place for a 2022 golden image to still be doing production-adjacent work in 2026.
• The pinned-dependency server. The box that stayed on 11 because some application "needed testing" before the upgrade to 12 — a task that has been six weeks away for three years.

Bullseye's timeline: release to wall

Every date below is from the Debian project's own lifecycle data (per-version detail: Debian 11 on endoflife.ai):

Note the shape: each handoff made Bullseye less visible while keeping it working. Oldstable felt the same as stable. LTS felt the same as the security team. September 1 will feel the same too — and that is the trap. The five-year arc from release to wall (August 14, 2021 to August 31, 2026) is Debian's standard rhythm; the same clock is already running on Bookworm.

September 1: what breaks (nothing — that's the problem)

End of support is not an outage. On September 1:

• Systems boot and serve traffic exactly as they did in August.
• apt update succeeds. The repositories don't vanish on day one — there is simply nothing new in them. A patching pipeline that reports "0 updates available" looks identical to a healthy one. (Debian eventually moves ended releases to its archive mirrors, as it has with every previous release — at which point unmodified sources lists start erroring. That failure, ironically, will be the first signal some owners ever get.)
• docker build succeeds. debian:bullseye stays on the registries. Every rebuild from it just bakes in the same aging package set, and each month the CVE count baked into "successful" builds grows.
• Vulnerability scanners drift into denial. Some tooling treats an EOL distribution as "no data" rather than "all findings permanent" — the scanner goes quiet exactly when the risk goes structural. This is the CVE blind spot, and Bullseye estates are about to walk into it.

The compliance angle is not silent, though. Frameworks and questionnaires increasingly ask the direct question — "do you run unsupported software?" — and on September 1 every Bullseye box flips your honest answer to yes.

The migration paths, with the wrinkle nobody mentions

Debian's in-place dist-upgrade between major releases is famously reliable — the OS jump is rarely the hard part. But the path has a wrinkle in 2026 that most "just upgrade to 12" advice ignores:

So the honest comparison of destinations looks like this:

What the 11 → 13 move actually involves:

1. You step through 12 — Debian upgrades one release at a time. Per the project's release notes, skip-level upgrades aren't supported: update 11 fully, edit sources to Bookworm, apt full-upgrade, reboot, verify — then repeat to Trixie. Two mechanical passes, one maintenance window each if rehearsed.
2. Budget the review time for the transitions, not the commands. The 11 → 12 hop carries the era's structural changes (the separate non-free-firmware component being the famous sources-list edit); config-file diffs during full-upgrade deserve a human eye on anything load-bearing.
3. The real work is application re-validation. Five years of library-major-version drift between Bullseye and Trixie is where the surprises are — which is an argument for starting the rehearsal upgrade this week, on a clone, not on August 30.
4. For fleets: rebuild beats upgrade where you can. Anything image-based (containers, CI runners, cloud instances from templates) is usually cheaper to re-base directly on 13 than to dist-upgrade twice in place.

Twenty-nine days is roughly one maintenance-window cycle for most organizations. It is enough for the machines you know about — if the sorting happens now. It is not enough to find the machines you don't know about and migrate them; for those, the realistic plan is discovery now, a bridge where needed, and migration on a schedule you control.

ELTS: the paid bridge

Debian is unusual among free distributions in having a well-established afterlife. Extended LTS (ELTS) is a commercial service operated by Freexian, run with the Debian project's blessing, that continues shipping security fixes after LTS ends. Freexian currently lists Bullseye ELTS coverage through June 30, 2031 — nearly ten years past the original release. Two properties worth understanding before budgeting on it:

• Coverage follows subscribers' packages, not the archive. ELTS maintains the set of packages its paying customers actually use. Mainstream server workloads are well covered; the long tail is covered when someone pays for it to be.
• It is a bridge with a meter. The precedent is healthy — Debian 10, whose LTS ended June 30, 2024, is still receiving ELTS fixes today, with coverage listed through June 30, 2029 — but every ELTS month is a month of paying to stand still. It buys an orderly migration; it should not replace one.

Commercial ELS vendors also cover Debian 11 within broader enterprise support bundles, which can make sense when Bullseye is one line item in a larger legacy estate. Compare the extended-support options → — or use the form above and we'll match you to vetted vendors for your specific situation.

The find-your-bullseye checklist

The 29 days are best spent on discovery. Bullseye hides in six places; check all six.

1. Hosts you manage. Across the fleet: cat /etc/os-release — Bullseye reports VERSION_CODENAME=bullseye, VERSION_ID="11". Any config-management or MDM inventory can run this in minutes; so can our Stack Scanner.
2. Dockerfiles and image registries. Grep every repo for the FROM lines: grep -rE 'FROM.*(bullseye|debian:11)' . — then check what's actually deployed, not just what's in git: docker images | grep -E 'bullseye|debian.*11', and inspect running containers with cat /etc/os-release inside. Remember the derived images: language and framework tags from the era (the -bullseye suffixed variants) carry the same OS underneath. Full method: the FROM-line audit.
3. CI/CD configuration. Search pipeline definitions for bullseye and debian-11 — runner images, build containers, test matrices. Build infrastructure touches everything you ship and is patched least.
4. Cloud templates. Launch templates, machine images, autoscaling groups, and IaC modules that reference Debian 11 AMIs/images — the next scale-up event shouldn't mint a brand-new unsupported server in September.
5. Appliances and vendor systems. Ask every vendor whose product runs Linux one question: "What OS release is inside, and what happens to it after August 31, 2026?" An SSH banner or support-bundle log often answers it faster than the vendor does.
6. The network's opinion. Where agent-based inventory can't reach, unauthenticated scans fingerprinting SSH versions typical of Bullseye are a coarse but effective net for the machines nobody admits owning.

Then sort what you find into three piles: migrate before August 31 (internet-facing, compliance-scoped, easy wins), bridge on ELTS/ELS (load-bearing and slow-moving — get coverage arranged before the wall, not after), and decommission — five-year-old servers include a satisfying number that no longer need to exist at all.

We track Debian and 480+ other products against vendor-verified dates — every Debian release, check any version in seconds, or see what else hits end of life this half. Debian 11 is the biggest date on the 2026 EOL calendar's August page, but it is far from alone this month.

Frequently Asked Questions

Related Resources

• Debian 11 End of Life: The August 31 LTS Cutoff, and What "End" Actually Means — the deadline guide: all three support tiers and the full version table
• Debian End-of-Life Dates — every release, every phase
• Debian 12's EOL — why the obvious upgrade target is already on its own clock
• Your Docker Base Images Are Quietly Dead: The FROM-Line Audit Nobody Runs
• Debian 11 — dates and risk score · all Debian releases
• The 2026 EOL Calendar — everything else with an August date