Your PHP version reached end of life. Your security doesn’t have to.
Supported Versions: PHP 7.1, 7.2, 8.1, 8.2, 5.6
PHP gives every version four years of support, then stops. PHP 8.1 and everything older no longer gets security patches, and PHP 8.2 joins them on December 31, 2026. Your servers keep running it, and the CVEs keep coming. NES for PHP ships patched runtimes of the PHP version you already run, as signed RPM and DEB packages and Windows installers. No code changes. No forced upgrade.
TRUSTED BY ENTERPRISE
Security, compliance, and continuity, solved together
With the HeroDevs secure drop-in replacement for end-of-life PHP, scanners stop flagging CVEs in end-of-life PHP versions for good.
Security
A new release ships each time a PHP vulnerability is found, validated, and fixed on versions the PHP project no longer patches, developed by HeroDevs engineers with core-maintainer expertise in PHP.
Fixes backported to the PHP version already in production
HeroDevs is an authorized CVE Numbering Authority and discloses discovered vulnerabilities
Compliance
Once installed, scanners stop flagging PHP vulnerabilities because the runtime is actively patched and commercially supported, turning open audit findings into closed ones.
SOC 2, PCI DSS, HIPAA, FedRAMP, ISO 27001, NIS2 and more
Documented patch history for auditors
Business continuity
A true drop-in replacement. Uses the same PHP version your code already targets, the same extensions and php.ini, and the same apt, dnf, or Windows install workflow. No refactoring.
Months or years of runway to migrate right
A fraction of migration cost or the cost of a breach.
PHP vulnerabilities already patched
If you're running end-of-life PHP versions today, your applications are exposed to the vulnerabilities below. NES for PHP fixes them without an upgrade.
A defensible answer for every standard, framework, or regulation.
Legacy software and unofficial community support undermines patch-management expectations across regulations worldwide. NES gives you a maintained, vendor-backed library with committed SLAs and a documented patch history to show auditors and regulators.
PCI DSS
Req. 6.3.3 requires known vulnerabilities to be patched, including a 30-day SLA for critical issues. Legacy PHP with no patch means immediate non-compliance — NES restores the patch path.
HIPAA
Unsupported components make it hard to show reasonable safeguards for systems handling ePHI. NES provides active maintenance and documented risk reduction.
SOC 2
Trust Services Criteria expect timely vulnerability remediation and patch management. Legacy components with no security patches translate to failing certification.
FedRAMP
Baselines build on NIST SI-2, requiring flaws to be corrected and security updates installed within defined timeframes. Unpatched legacy software in government cloud does not meet compliance.
DORA
Treats legacy software as a resilience flaw for financial ICT assets. NES sustains a documented patch-management program for critical systems.
NIS2 Directive
Article 21 covers patching, vulnerability and supply-chain management. Legacy unpatched software is effectively non-compliant where it creates risk.
GDPR
Article 32 expects "state of the art" technical measures. Running unsupported legacy software is difficult to defend after a breach — NES keeps the web server maintained.
NIST CSF 2.0
Control PR.PS-02 requires organizations to actively maintain or remove vulnerable software based on risk. NES enables compliance without forced upgrade or removal.
Cyber Resilience Act
Requires vulnerabilities in products and their components to be handled effectively during the support period. NES keeps the PHP layer of shipped products covered.
ISO/IEC 27001:2022
Vulnerability Management and Configuration Management controls require identifying technical vulnerabilities and keeping software within secure standards. NES restores control posture with patch availability for EOL software.
CIS Controls v8
Control 7 (Continuous Vulnerability Management) and Control 2 (Software Asset Inventory) treat software that no longer receives security updates as inherently vulnerable. NES keeps software patched and auditable.
Commercial Contracts
Many organizations are contractually prohibited from shipping unsupported software. NES provides the vendor-backed answer those policies require.
Frequently Asked Questions
Contact Us
Got questions about Never-Ending Support for your open-source library? We're here to help!
Discover how HeroDevs NES Products can keep your systems secure and compliant.
Learn how our solutions can deliver value to your organization.
Get detailed pricing information tailored to your needs.
Resources
View All Articles
