Determinate Secure Packages launches emergency extension for NixOS 25.05

Determinate Secure Packages has introduced an Emergency Legacy Extension for the NixOS 25.05 distribution to address significant security risks. Organizations using this version face exposure to hundreds of critical vulnerabilities, as the distribution has been unmaintained for nearly a year and was scheduled to reach end-of-life on December 31, 2025.

The extension provides guaranteed support until at least Q4 2027 and includes immediate patches for several high-profile disclosures. Recent remediation efforts include removing eMudhra certificates, addressing PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619), and working on a fix for the Brotli remote code execution vulnerability (CVE-2026-111497). Additionally, hundreds of CVEs have been remediated across critical packages such as curl, OpenSSL, Unbound, and Node.

Separately, security advisories highlight critical PHP remote code execution (RCE) vulnerabilities affecting various environments, including dockerized WordPress installations. These vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, can allow unauthenticated remote code execution. Experts note that updating WordPress core or plugins is insufficient; the underlying PHP executable must be replaced with a patched build, such as PHP 8.2.8.35, 8.3.36, 8.4.27, or 8.5.12.