Emergency Legacy Extension now available for NixOS 25.05

Organizations depending on the 25.05 distribution are substantially behind on security updates and are exposed to hundreds of critical vulnerabilities. Recent advances in autonomous security analysis tools are only making this more evident.

In response to the last week’s disclosures and the general uptick in vulnerability disclosures we are now offering Determinate Secure Packages 25.05 (Emergency Legacy Extension). The distribution is now available for purchase, we can onboard you the same day, and we guarantee support until at least Q4 2027.

If you run NixOS 25.05 in production, you can significantly reduce your risk profile and ship patches before the end of the day.

What’s patched today

We’ve already patched our 25.05 distribution against several high-profile disclosures, with more in the merge queue:

• eMudhra. We have removed the eMudhra certificates from cacerts. We’ve also patched dozens of programs in the long tail of software that bundles its own, outdated certificate bundle.
• PHP. Within two hours of PHP’s release, we built and merged patches for CVE-2026-109618 and CVE-2026-109619 (“PHP2Shell”).
• Brotli. A fix for CVE-2026-111497, the Brotli remote code execution vulnerability, is in progress and will land shortly.
• Hundreds more. We have remediated hundreds of CVEs across curl, OpenSSL, Unbound, Node, and other critical-path packages. We are continuing to triage the known vulnerabilities and expand coverage.

Why we’re doing this

Since the launch of Determinate Secure Packages we’ve had several customers request NixOS 25.05 support. Despite that release going end-of-life on December 31, 2025, some users are unable to update for regulatory or other practical reasons. It has now been unmaintained for nearly a year without security updates and represents a significant risk to these organizations.

This week’s disclosures have significantly exacerbated the risk. The Emergency Legacy Extension means we take the same process and CVE remediation work we already do for Determinate Secure Packages on rolling, 26.05, and 25.11, and apply it to 25.05 as a standalone product, available to anyone who needs it.

What to expect

Our coverage of 25.05 is brand new, which means there is a lot of catch-up work to be done.

• Coverage is about a thousand packages today. Our initial focus is the common base of a production NixOS system. You should expect to compile some software at the start.
• Triage is ongoing. This distribution has gone unmaintained for nearly a year. Our intake process triages and resolves the highest severity issues before expanding our package set coverage.
• Our SLA is not yet active. Once we move out of the initial intake process, we will switch to SLA-maintenance.

Additionally, as with every distribution, Determinate Secure Packages 25.05 (Emergency Legacy Extension) comes with:

• CVE remediation backed by an SLA (after the initial intake period)
• Full cache coverage in FlakeHub Cache
• Access to FlakeBOM, our lightning-fast CLI for generating SBOMs in CycloneDX format
• Cryptographically signed packages

Support timeline

We are planning to support the Emergency Legacy Extension for NixOS 25.05 through at least Q4 2027.

Get it today

We can move quickly to onboard you right away. After signing a contract, we will grant you access to 25.05 on FlakeHub. After that, you point to FlakeHub for Nixpkgs, rebuild, and deploy. You do not need to use Flakes to use our distribution.

If you’re facing emergency patching on 25.05 this week, we can help you solve it today.