Built on the endoflife.date open dataset
End-of-life intelligence
for every major stack.
endoflife.ai is a free public platform for software end-of-life intelligence, built on top of the endoflife.date open dataset. Paste your package.json or requirements.txt and get an EOL risk verdict for your whole stack — or check a single product. Instant and free.
Data reconciled from official vendor lifecycle pages, endoflife.date, NVD and CISA KEV — every date carries its source. How we source data →
500+
Products Indexed
8,000+
Pages & Score Cards
<7
Days to Exploit a New CVE
$0
Cost to Check
Trusted by security and engineering teams — free, no account required
500+
Products Tracked
<7
Days to Exploit a New CVE
8,000+
Pages & Score Cards
$0
Cost Forever
Windows 10 — EOL Oct 2025
CentOS 7 — EOL Jun 2024
AngularJS — EOL Dec 2021
MySQL 5.7 — EOL Oct 2023
PHP 8.1 — EOL Dec 2025
Node.js 20 — EOL Apr 2026
MySQL 8.0 — EOL Apr 2026
Python 3.10 — EOL Oct 2026
PostgreSQL 14 — EOL Nov 2026
PHP 8.2 — EOL Dec 2026
Python 3.13 — Supported
Node.js 22 LTS — Supported
PostgreSQL 17 — Supported
Ubuntu 24.04 LTS — Supported
Kubernetes 1.33 — Supported
Windows 10 — EOL Oct 2025
CentOS 7 — EOL Jun 2024
AngularJS — EOL Dec 2021
MySQL 5.7 — EOL Oct 2023
PHP 8.1 — EOL Dec 2025
Node.js 20 — EOL Apr 2026
MySQL 8.0 — EOL Apr 2026
Python 3.10 — EOL Oct 2026
PostgreSQL 14 — EOL Nov 2026
PHP 8.2 — EOL Dec 2026
Python 3.13 — Supported
Node.js 22 LTS — Supported
PostgreSQL 17 — Supported
Ubuntu 24.04 LTS — Supported
Kubernetes 1.33 — Supported
Free Tool
Scan Your Entire Stack
Upload a dependency file or paste your packages — requirements.txt, package.json, Gemfile, pom.xml, go.mod and more. Every line gets a lifecycle verdict from the same verified database that powers the whole site.
Privacy: Your dependency files are never stored or transmitted. Scanning happens entirely in your browser against endoflife.ai’s own verified lifecycle database, fetched as a single static file — your package list never leaves this page.
Drop your dependency file here
or click to browse
SBOM (CycloneDX/SPDX)
requirements.txt
package.json
Gemfile
composer.json
pom.xml
go.mod
Cargo.toml
build.gradle
or paste directly
Prefer a full page? Open the standalone Stack Scanner →
Free Tool
The EOL Checker
Instant lifecycle status for any software product. Paste in a product name and know your risk in seconds.
$ eol check
Product
Windows 10
EOL Date
Oct 14, 2025
Status
End of Life
CVE Blind Spot Detected. This product no longer receives security patches. Attackers diff new CVE fixes against your EOL build — your scanner won't alert you. They know. You don't.
The Problem
Your scanner has a
blind spot.
CVE reporters only test supported software. When a vulnerability is discovered in code that also exists in your EOL version, they don't check — and neither does your scanner.
01
Incomplete CVE Reporting
Security researchers report vulnerabilities in supported versions only. EOL versions share the same vulnerable code but never appear in the advisory.
02
False Scanner Confidence
Your vulnerability scanner checks CVE affected version ranges. Your EOL version falls outside that range. No alert fires. You believe you're safe.
03
Attackers Know First
Threat actors read advisories and diff patches. They test EOL builds systematically. This isn't a zero-day — it's worse. They know. You don't.
Attack Chain — EOL Software
1
CVE Published
Vulnerability disclosed in supported versions only. Your EOL build has the same code.
Vulnerability disclosed in supported versions only. Your EOL build has the same code.
2
Attacker reads the advisory
Diffs the patch. Tests against EOL builds. Confirms vulnerability present.
Diffs the patch. Tests against EOL builds. Confirms vulnerability present.
3
Your scanner runs
Checks CVE affected version range. EOL version not listed. No alert fires.
Checks CVE affected version range. EOL version not listed. No alert fires.
4
You believe you're clean
Dashboard shows green. Breach window is open.
Dashboard shows green. Breach window is open.
✓
endoflife.ai flags it first
EOL detected. CVE blind spot warning surfaced. Risk known before attacker acts.
EOL detected. CVE blind spot warning surfaced. Risk known before attacker acts.
Running end-of-life software?
Get matched with extended support — free →
✓ We don't just publish EOL dates — we check them: 54 flagship products cross-checked against official vendor documentation, 11 vendor-published updates caught early and contributed back to the ecosystem.
How we verify →
Proprietary Intelligence
EOL Risk Score™
Every product and version page on endoflife.ai displays a proprietary 0–100 risk score — calculated at build time from four factors your vulnerability scanner doesn't track.
1
EOL Recency — 40 pts
How long past EOL — or how soon approaching. Accumulates over time with no reset.
2
Attack Surface — 30 pts
Critical tier for OS, runtimes, databases. High for frameworks and tools.
3
CISA KEV Exposure — 20 pts
Products with confirmed active exploitation history in the CISA KEV catalog.
4
Extended Support — 10 pts
No commercial patch vendor available means higher residual risk.
EOL Risk Score™ on all 8,000+ pages. Recalculated at every build.
Full Methodology →
Resource Hub
Lifecycle Intelligence
Guides, timelines, and analysis for security and engineering teams managing software lifecycles.
Start here — EOL for beginners.
Six short guides, zero prior knowledge assumed. Read in order or jump in anywhere.
1
What is EOL software?Every term & acronym · 12 min
2
What is a CVE?IDs, CVSS, KEV & EPSS · 11 min
3
Runtime vs framework vs libraryWhy the layer changes everything · 10 min
4
What is LTS?Support windows & the trap · 9 min
5
What is a dependency?Lockfiles, semver & SBOMs · 10 min
6
The day after EOLWhat actually happens · 9 min
Security Feed · Live
Exploited & Unpatchable
The vulnerabilities that are both actively exploited — on CISA's Known Exploited Vulnerabilities catalog — and affect software past end-of-life, where the fix ships only to supported versions and none is expected for the end-of-life one. Every entry hand-verified against the vendor's own advisory. Free JSON feed.
Data Report · 2026
The State of End-of-Life Software 2026
Our original analysis of 459 tracked technologies: 32 are tied to actively-exploited vulnerabilities, 30 score Critical, and 190 have a release reaching EOL this year. Full data tables and the 2026 EOL calendar.
New · Sep 11, 2026
GitLab CVE-2026-85706: Six Lines Without a Fix, 19.1 Ends September 17
CISA added CVE-2026-85706, a CVSS 10.0 unauthenticated path traversal in GitLab's repository commits API, to its Known Exploited Vulnerabilities catalog on September 11, 2026 with a September 14 deadline.
New · Sep 10, 2026
MikroTik RouterOS on CISA KEV: 6.49.21 Is the Only Fix for Any 6.x
CISA added CVE-2026-86060 and CVE-2026-67277 to its Known Exploited Vulnerabilities catalog on September 10, 2026 with a September 13 deadline.
New · Sep 10, 2026
Cisco FMC CVE-2026-20079: Fixed on Six Trains, Silent on 7.3 and 7.1
Cisco's CVSS 10.0 Firewall Management Center authentication bypass is exploited by three groups, Talos said the day CISA listed it. Hot fixes cover 7.0, 7.2, 7.4, 7.6, 7.7 and 10.0.
New · Sep 9, 2026
Microsoft Moved the Windows 10 Deadline in a Footnote. Even We Missed Four Pages.
Microsoft extended Windows 10 consumer Extended Security Updates to October 12, 2027 with an editor's note on June 25, 2026, not an announcement. Most trackers, and four of our own pages, kept saying October 2026 for 76 days.
New · Sep 8, 2026
Adobe Patched Magento Versions It Stopped Supporting. Open Source Stores Below 2.4.6 Got Nothing.
CVE-2026-75650, a CVSS 10.0 unauthenticated remote code execution flaw in Adobe Commerce and Magento Open Source, exploited since September 4 and in CISA's KEV catalog since September 8.
New · Sep 7, 2026
AWS App Mesh Shuts Down September 30, 2026 — What Happens and Where to Move
AWS does not merely end support for App Mesh on September 30, 2026: the console and every mesh resource become inaccessible.
New · Sep 7, 2026
Fin de support RHEL 8 et RHEL 9 : dates 2026
RHEL 8 : fin de support le 31 mai 2029. RHEL 9 : fin de support le 31 mai 2032. RHEL 10 : fin de support le 31 mai 2035. RHEL 7 : fin de vie le 30 juin 2024 (ELS RHEL 7 jusqu'au 31 mai 2029).
New · Sep 6, 2026
November 10, 2026: Four Support Clocks Run Out on One Patch Tuesday
On November 10, 2026, .NET 8 (LTS) and .NET 9 both reach end of life, PowerShell 7.4 (LTS) and 7.5 end the same day, and Windows 11 23H2 Enterprise and Education stops being serviced.
New · Sep 5, 2026
Firefox ESR End of Life & Support Options: What To Do When ESR Patches Stop (140 ESR Ends September 29, 2026; 153 ESR Current)
Firefox 140 ESR reaches end of life on September 29, 2026; Firefox 153 ESR (released July 21, 2026) is the replacement, and 115 ESR stays patched for older Windows and macOS until March 31, 2027.
New · Sep 5, 2026
How to Audit an SBOM for End-of-Life Software — Four Real SBOMs, 21,347 Components, and Why Name Matching Is the Wrong Tool
An SBOM lists what you ship; it does not say whether any of it is still supported. How to join CycloneDX and SPDX components to lifecycle data by package URL (exact) instead of by name (a guess), what endoflife.ai's purl map…
New · Sep 4, 2026
Cisco's RV Routers Run Out: The Last Small Business RV Models Lose Support on September 30 and October 31, 2026, With No Replacement
Cisco's Small Business RV routers reach their Last Date of Support in two waves: RV160, RV160W, RV260, RV260W, RV260P, RV340W and RV345P on September 30, 2026, and RV340 and RV345 on October 31, 2026.
New · Sep 4, 2026
Moodle 5.0 Reaches End of Life on October 5 — and 5.1 Leaves General Support the Same Day
Moodle 5.0's security support ends October 5, 2026; general support ended April 20, 2026. On the same day Moodle 5.1 leaves general support and runs security-only to April 19, 2027, while the older 4.5 LTS is supported to October…
New · Sep 4, 2026
No, NetScaler 13.1 Does Not Die on September 15 — That Is End of Maintenance, and End of Life Is a Year Later
Coverage this week says NetScaler ADC firmware 13.1 reaches end of life on September 15, 2026. The vendor's release-cycle article CTX241500 says otherwise: 13.1 reaches End of Maintenance on September 15, 2026 and End of Life on…
New · Sep 4, 2026
Microsoft Starts Switching Off Exchange Web Services on October 1 — and the Opt-In Window Already Closed
Exchange Web Services in Exchange Online: phased disablement starts October 1, 2026 and EWS is fully and permanently disabled April 1, 2027, with no exceptions. The end-of-August opt-out window has passed.
New · Sep 3, 2026
JFrog Patched Every Supported Artifactory Branch in a Day. The Exposure Is on the Ones It No Longer Supports.
CISA has confirmed exploitation of CVE-2026-82329, a CVSS 9.8 authentication bypass to administrator in JFrog Artifactory, with a federal due date of September 5, 2026. JFrog fixed all six supported branches on August 28.
New · Sep 3, 2026
SonicWall SMA 1000 Under Active Attack: A CVSS 10.0 SSRF, a Federal Deadline of September 5, and the Sixth KEV Entry Since January 2025
SonicWall confirms active exploitation of two SMA 1000 vulnerabilities, one a CVSS 10.0 pre-authentication SSRF, and CISA has given federal agencies until September 5, 2026.
New · Sep 3, 2026
SonicWall's Gen 6 Cliff: TZ, NSA and NSa Firewalls Lose Support on October 1, 2026 - Half of Them Already Have
SonicWall's Gen 6 firewalls reach End of Support in two waves: TZ400, TZ600, NSA 3600 and NSa 3650 on August 1, 2026, and TZ350, TZ500, SOHO 250, NSA 4600 to 6600 and NSa 4650 to 6650 on October 1, 2026.
New · Sep 3, 2026
The ASA 5500-X Is Over: Cisco's 5506-X, 5508-X and 5516-X Passed Their Last Date of Support on August 31, 2026
Cisco's ASA 5506-X, 5508-X and 5516-X reached their Last Date of Support on August 31, 2026, a year after the 5525-X, 5545-X and 5555-X.
New · Sep 2, 2026
Exploited, Abandoned, Still Online: The End-of-Life Routers CISA Keeps Ordering Unplugged
Seven CISA KEV entries share an unusual required action: not patch - disconnect. D-Link routers end-of-life since 2017 and Zyxel DSL gateways 'EOL for years' keep landing in the exploited catalog, one almost seven years after the…
New · Sep 2, 2026
FortiManager 7.2 Hits End of Support October 11 - the FortiJump Line Runs Out of Road
FortiManager 7.2 reaches End of Support October 11, 2026 per Fortinet's own lifecycle portal - and engineering support already ended April 2025.
New · Sep 2, 2026
Ivanti's Hardware Cliff: ISA6000 and ISA8000 Reach End of Life January 31, 2027 - and Take Connect Secure 22.x With Them
Ivanti's ISA6000 and ISA8000 appliances reach end of support and end of life on January 31, 2027 - the hardware under the most-exploited VPN in CISA's KEV catalog.
New · Sep 1, 2026
PaperCut NG/MF Is Being Exploited — and Versions 23 and Earlier Are Not Getting the Patch
CVE-2026-82078 and CVE-2026-81578 chain into pre-auth RCE against PaperCut NG/MF, on CISA's KEV since August 31, 2026 with a September 14 federal deadline. Emergency Patch Release 3 covers v24/v25/v26 only
New · Sep 1, 2026
Ivanti Connect Secure Hits End of Support Days Before CISA's Edge-Device Deadline
ICS 22.7, 22.8 and the 25.1.0-25.1.2 releases all reach End of Support on January 31, 2027 - days before BOD 26-02's twelve-month decommission deadline lands in early February.
New · Sep 1, 2026
September 30, 2026: The Worst Deadline Day of the Quarter
Four unrelated vendors, one date: Project Online retires outright, FortiOS 7.2 and four SonicOS releases hit end of support, ten Azure services shut down - with ASA 9.23's end-of-sale the day before and NetScaler 13.1's end of…
New · Sep 1, 2026
Microsoft Project Online Retires September 30 — and It's Missing From Microsoft's Own 2026 End-of-Support List
Project Online retires September 30, 2026 under the Modern Lifecycle Policy — the service stops, not just support, and Microsoft's guidance is to back up data first.
New · Sep 1, 2026
End of Support vs. End of Life: What's the Difference?
There is no industry standard — EOS and EOL mean whatever each vendor says they mean. The decoder: what Microsoft, Red Hat, Cisco, Oracle, Canonical, Fortinet, PHP, Python, CISA and vendors that publish nothing actually mean, the…
New · Aug 30, 2026
October 13, 2026: The Day Three Windows Support Clocks Run Out
On one Patch Tuesday — October 13, 2026 — the final ESU year for Windows Server 2012 and 2012 R2 ends, Windows 10's first commercial ESU year expires (consumer ESU now runs to October 12, 2027), and Windows Server 2022 leaves…
Risk Intelligence · Aug 2026
Oracle Legacy Middleware End of Life: Discoverer, Endeca, Forms 11g — and Why Oracle Never Says “Dead”
Oracle Discoverer's last patches shipped June 2017. Endeca's between 2018 and 2021. Forms and Reports 11g in 2018. None of them ever got an end-of-life announcement — they slid into indefinite Sustaining Support instead.
OS · Aug 2026
Ubuntu End of Life: Every Version's Dates — 22.04, 24.04, 20.04 and the Three Support Clocks
Ubuntu 22.04 LTS standard support ends May 31, 2027; 24.04 runs to May 31, 2029 (ESM to 2034); 20.04 left standard support in May 2025 and is ESM-only to April 2030; 16.04's ESM closed in April 2026 making it fully end of life.
Risk Intelligence · Aug 2026
Apache Tomcat Marks Dead Versions "Unknown" — and Your Scanner Reads That as Clean
Apache Tomcat's own security pages state that for end-of-life versions the status of new vulnerabilities defaults to unknown, the pages are never updated, and no announcement is made.
Security · Aug 2026
Gitea's First KEV Entry: CVE-2026-60004, a Two-Day Federal Deadline, and a Release Policy With Nowhere to Hide
CISA added CVE-2026-60004 - a CVSS 9.8 code-injection flaw in Gitea's diffpatch endpoint - to the KEV catalog on August 25 with an August 28 deadline.
Security · Aug 2026
WebLogic's Perfect-Score KEV Entry: CVE-2026-21962, a Three-Day Federal Deadline, and the Versions That Will Never Get the Patch
CISA added CVE-2026-21962 - a CVSS 10.0, unauthenticated flaw in Oracle HTTP Server and the WebLogic Server Proxy Plug-in - to the KEV catalog on August 24 with an August 27 deadline.
Risk Intelligence · Aug 2026
The QRadar SaaS Shutdown: What Dies August 31, What Is Already Gone, and Why There Is No Extended Support
Palo Alto Networks retires the QRadar SaaS products acquired from IBM: QRadar EDR, X-Force Threat Intelligence, Randori Attack and QRadar Advisor with Watson all reach end of life August 31, 2026 - and Randori Recon,…
Framework · Aug 2026
Azure Retires 20+ Services and APIs This September — Seven Separate Deadlines, One Table
Microsoft’s own 2026 end-of-support page lists more than twenty Azure services, APIs and SDKs shutting down across seven September dates — 13, 14, 15, 17, 19, 21 and 30 September 2026.
Security · Aug 2026
Zimbra End of Life: 8.8.15, 9.0 and 10.0 Get No Fix for Exploited CVE-2026-73570
CISA added Zimbra’s CVE-2026-73570 (unauthenticated OS command injection via the optional SNMP component, CVSS 8.9) to the Known Exploited Vulnerabilities catalog on August 21, 2026 with an August 24 federal deadline.
Security · Aug 2026
The Backport Myth: We Tried to Prove 624 EOL Versions Were Unpatchable. Vendors Kept Proving Us Wrong.
Original research: 624 candidate (product × CVE) pairs from crossing CISA’s exploited-vulnerabilities catalog with verified end-of-life data — the ~98 most plausible verified line-by-line against vendor advisories.
OS · Aug 2026
IBM z/OS 2.5 End of Support: September 30, 2026 — the Three-Year Paid Extension, and the Move to 3.1 or 3.2
IBM's lifecycle page puts z/OS 2.5 end of support at September 30, 2026 (GA September 30, 2021; withdrawn from marketing January 29, 2024). z/OS follows the Enhanced policy — five years standard, up to three more paid
Risk Intelligence · Aug 2026
Ansible Automation Platform 2.5: Maintenance Support 1 Ends October 2, 2026 — What Still Gets Fixed After That, and Until When
Red Hat AAP 2.5 leaves Maintenance Support 1 on October 2, 2026 — the last phase with Important-severity security fixes and any bug fixes. Maintenance Support 2 (Critical-only) runs to October 2, 2027.
Risk Intelligence · Aug 2026
Altiris End of Life: The Product Is Now Symantec ITMS Under Broadcom — 8.6 Died June 1, 2026, and Everything Before 8.5 Is Long Gone
'Altiris' lifecycle data lives under Symantec IT Management Suite on Broadcom's portal. Verified there: every version before 8.5 is end of life; ITMS 8.6 and its component suites reached end of support June 1, 2026;
Runtime · Aug 2026
Java’s September 2026 Cliff: Nine Runtime Lines Reach End of Life in One Month — Including Oracle JDK 17 Premier Support
Nine Java runtime lines reach end of life in September 2026: SapMachine 17 (Sep 1), the non-LTS 26 series across six vendors as JDK 27 ships, and — the big one
Security · Aug 2026
MLflow 2.x: Actively Exploited (CVE-2026-64849), Fixed Only in 3.15 — and Never Declared End of Life
CISA added MLflow’s CVSS 9.3 SSRF flaw CVE-2026-64849 to the Known Exploited Vulnerabilities catalog on August 19, 2026 with a September 2 federal deadline. GitHub’s advisory records the fix as first patched in 3.15.0
Database · Aug 2026
IBM Netezza End of Life: The Last Appliance Died April 30, 2023 — No Service Extensions, and the Product Lives On Only as Netezza Performance Server
IBM's lifecycle page for the final Netezza appliance generation (PureData System for Analytics N3001, 'Mako') shows end of support April 30, 2023 — with service extensions explicitly not available.
OS · Aug 2026
Microsoft Master Data Services End of Life: Removed in SQL Server 2025, Supported Only While SQL Server 2022 Is
Master Data Services (MDS) is removed in SQL Server 2025 and supported only in SQL Server 2022 and earlier — so its end of life is SQL Server 2022's: mainstream support to January 11, 2028, extended support to January 11, 2033.
OS · Aug 2026
VMware Perpetual License End of Availability: What Broadcom Ended, What Still Works, and What Happens When Your Support Expires
VMware perpetual licenses are end of availability, not end of life: Broadcom stopped selling them and SnS renewals (announced December 2023, listed January 2024), existing licenses keep running and are supported to the end of…
Framework · Aug 2026
Drupal 7 End of Life: Support Ended January 5, 2025 — What Stopped, What Still Runs, and the Two Ways Forward
Drupal 7 reached end of life on January 5, 2025 — no more security or compatibility fixes for core or contributed modules.
Security · Aug 2026
Symfony End of Life: Every Version's Dates — 2.8, 3.4 and 4.4 Are Dead, 5.4 Is Security-Only to 2029, 6.4 and 7.4 Are the LTS Lines
Symfony 2.8 LTS ended November 1, 2019, 3.4 on November 1, 2021, 4.4 on November 21, 2023. Today's LTS lines: 5.4 (security fixes only, to February 28, 2029), 6.4 (bug fixes to November 30, 2026, security to November 30, 2027)…
Security · Aug 2026
Two KEV Entries, One Lesson: macOS Ventura Gets No Fix at Any Price, Windows 10 Gets One Only Behind ESU
On August 18, 2026 CISA added two actively exploited flaws to its KEV catalog that are end-of-life stories. CVE-2026-65400 (macOS Screen Sharing authentication bypass) was fixed August 6 only in Tahoe 26.6.1, Sequoia 15.7.9 and…
Security · Aug 2026
vCenter 7.0 and CVE-2026-59310: Actively Exploited, Fixed Only for Extended-Support Contracts — What Broadcom's Advisory Actually Says
CISA added CVE-2026-59310 (CVSS 9.8, path traversal in the vCenter Syslog server, remote code execution) to its KEV catalog on August 18, 2026, deadline August 21.
Risk Intelligence · Aug 2026
The Atlassian Double Cliff: Bamboo 10.0 Dies August 21, Jira Software 10.0 Dies August 22
Atlassian's two-year rule retires Bamboo 10.0 on August 21, 2026 and Jira Software 10.0 on August 22 — one day apart, and most Atlassian shops run both. Neither is an LTS.
Risk Intelligence · Aug 2026
Confluence End of Life: Every Version Dies Two Years After Release — and the 7.x Holdouts Are Three LTS Lines Behind
Atlassian retires every Confluence version exactly two years after its release. Confluence 7.13 LTS died August 17, 2023, 7.19 LTS on December 13, 2024, 8.5 LTS on December 15, 2025 — and 9.2 LTS goes on December 10, 2026.
Database · Aug 2026
Elasticsearch End of Life: Why 8.19 Outlives 9.1, 9.2 and 9.3 — Every Version's Real Date
Elasticsearch minors live about six months — 9.1, 9.2 and 9.3 are already end of life — but the LAST minor of each major gets the long tail: 8.19 is supported to July 15, 2027, outliving three 9.x releases.
Runtime · Aug 2026
NumPy 2.1 End of Life: August 19, 2026 — and the Same Day, Python 3.11 Falls Off NumPy's Floor
NumPy 2.1 reaches end of life on August 19, 2026 under NEP 29's 24-month rule. The same schedule drops Python 3.11 from NumPy's support floor that day (3.12+ / 2.2+ from August 19), even though Python 3.11 itself lives to October…
OS · Aug 2026
The Whole Proxmox 8 Era Ends August 31, 2026 — VE, Backup Server, and Mail Gateway Together
Proxmox VE 8, Proxmox Backup Server 3, and Proxmox Mail Gateway 8 all reach end of life on August 31, 2026 — the same day, because all three ride Debian 12's security lifecycle.
Risk Intelligence · Aug 2026
Bitbucket 9.1 Dies August 27, 2026 — and a Bitbucket Version Dies Every Month Through Year-End
Bitbucket Data Center 9.1 reaches end of support on August 27, 2026, exactly two years after release — and Atlassian's two-year clock retires 9.2 in September, 9.3 in October, and the 9.4 LTS in December.
OS · Aug 2026
containerd 1.7 Ends September 1, 2026 — the Last 1.x Line Under Your Kubernetes Nodes
containerd 1.7, the final 1.x release line, reaches end of life on September 1, 2026 after three and a half years as an LTS. It is the container runtime under most Kubernetes nodes and Docker hosts
OS · Aug 2026
Kubernetes LTS Does Not Exist Upstream — Here Is What Actually Buys You Time
There is no Kubernetes LTS release: every minor version gets roughly 14 months (12 standard + 2 maintenance) and a new one ships every four months. Long-term support does exist
Risk Intelligence · Aug 2026
Apache Camel 4.14 Went EOL Nine Days Early — and the Vendor Pages That Would Tell You Are Gone
Apache Camel 4.14 reached end of life on August 11, 2026 — nine days before the August 20 date most trackers still publish — because Camel ends an LTS when the next LTS ships, and 4.22 shipped early.
OS · Aug 2026
CentOS Extended Support in 2026: Who Still Patches CentOS 7 and 8 — and What It Buys You
CentOS 7 has been end-of-life since June 30, 2024 and CentOS 8 since December 31, 2021 — yet both still run production fleets.
Security · Aug 2026
Traefik 3.6 End of Life: August 16, 2026 — the First Traefik Minor With a Security Tail
Traefik 3.6 reaches end of security support on August 16, 2026. It is the first Traefik minor ever given a security tail — before the v3.6 policy change, the average 3.x minor lived 93 days and died the day its successor shipped.
Risk Intelligence · Aug 2026
Grafana 12.3 End of Life: August 19, 2026 — and 12.4 Outlives Every Grafana 13
Grafana 12.3 reaches end of life on August 19, 2026 — exactly nine months after release. Grafana's 15-month window only applies to the last minor of a major line, which is why 12.4 (EOL May 24, 2027) outlives both Grafana 13.0…
Risk Intelligence · Aug 2026
Mattermost 10.11 Ends August 15, 2026 — and the Newest Release Is the Wrong Upgrade
Mattermost 10.11 reaches end of life on August 15, 2026. It is one of only two releases in 55 that got a twelve-month support window instead of the usual three — and the newest release, 11.9, expires on October 15, 2026.
Security · Aug 2026
CVSS 9.8, EPSS 10.7%, and Confirmed Exploited: When the Three Scores Disagree
CVSS says how bad, CISA KEV says whether it is being exploited, EPSS says how likely it is next. On our Exploited & Unpatchable feed they openly disagree
Framework · Aug 2026
React のサポート期限はいつまで？公式の EOL 日は存在しません【2026年8月版】
React には公式のサポート期限（EOL 日）が存在しません。React 19・18・17・16・15 の公開日・最終リリース日・EOL リスクスコアを一覧で整理し、「期限がない」ことが安心材料ではない理由、React 18 の「凍結」状態の見分け方、CVE-2025-55182 の正確な影響範囲、稟議や保守契約で使える判断材料までを日本語で解説します。
Security · Aug 2026
ESXi 6.5, 6.7 & 7.0 CVEs: What Is Unpatched — and What Will Never Be Patched
Five KEV-listed CVEs map onto EOL ESXi versions: CVE-2024-37085 is ransomware-exploited and Broadcom lists ESXi 7.0 as No Patch Planned; 6.5 and 6.7 stopped receiving fixes in 2022 and carried the ESXiArgs wave.
Security · Aug 2026
Confluence Server End of Life: Two Years Past Support, Three Exploited CVEs, and No Patch Ever Coming
Confluence Server reached end of life February 15, 2024. Three CISA KEV-listed CVEs — including CVSS 10.0 CVE-2023-22518, mass-ransomed since November 2023 — have fixes only on supported branches.
Security · Aug 2026
The TeamCity RCE Under Active Exploitation Will Never Be Patched on Nine Version Lines — CVE-2026-63077
CVE-2026-63077, an unauthenticated RCE in JetBrains TeamCity added to CISA KEV on August 5, 2026, is fixed only in 2025.11.7 and 2026.1.3. Nine EOL version lines will never receive the fix.
Security · Aug 2026
The ActiveMQ RCE on CISA's KEV Will Never Be Patched on Five Version Lines — CVE-2026-34197
CVE-2026-34197, the exploited ActiveMQ RCE via the Jolokia JMX-HTTP bridge (effectively unauthenticated on 6.0/6.1), is fixed only in 5.19.4 and 6.2.3 — five EOL lines (5.16–5.18, 6.0, 6.1) will never receive the patch.
Security · Aug 2026
The Roundcube RCE on CISA's KEV List Will Never Be Patched on 1.4, 1.3, or 1.2 — CVE-2025-49113
CVE-2025-49113, the KEV-listed deserialization RCE in Roundcube Webmail, is fixed only in 1.5.10 and 1.6.11 — the EOL 1.4, 1.3, and 1.2 lines will never receive a patch, leaving upgrade or decommission as the only fixes.
OS · Aug 2026
VMware Cloud Foundation End of Life: 4.x Is Dead, 5.x Ends in 2027, and VCF 9.0 Expires Before 5.2
Every VMware Cloud Foundation 4.x release is already end of life — 4.5, the last of the line, ended May 31, 2025. VCF 5.0 and 5.1 both die June 1, 2027; 5.2 follows October 11, 2027.
Risk Intelligence · Aug 2026
What Extended Support Actually Costs: The Cross-Vendor Pricing Reference for Post-EOL Software
The first cross-vendor pricing reference for post-EOL extended support. Microsoft ESU: $61/device doubling yearly ($30 one-time for consumers). AWS: EKS $0.60/cluster-hour (6x), RDS $0.100/vCPU-hour doubling in year three.
Framework · Aug 2026
IBM MQ End of Support: Every Date Lands on September 30 — 9.2 Crossed Last Year, 9.3 Is Next, and 9.4 Has No Date Yet
IBM MQ 9.3 end of support is September 30, 2027 (extended support to 2031) — and MQ 9.2's standard support already ended September 30, 2025.
Risk Intelligence · Aug 2026
Palo Alto End of Life Has Two Clocks: Every PAN-OS Software Date, the Hardware Dates People Actually Search For, and Why 11.0 Died Before 10.2
Palo Alto publishes software EOL per PAN-OS release and hardware EOL per appliance, on two different pages. PAN-OS 11.2 dies May 2, 2027 — one day before the older 11.1 — and 10.2 already passed August 27, 2025.
Framework · Aug 2026
Oracle 19c End of Support Date: December 31, 2029 — a Date That Already Moved Once, and the Trap Waiting in 21c
Oracle Database 19c Premier Support ends December 31, 2029, with Extended Support to December 31, 2032 — dates Oracle extended in November 2024 from the original April 2024/2027 schedule.
OS · Aug 2026
IBM i End of Life: 7.4 Has 49 Days of Standard Support Left — and Whether You Call It AS/400, iSeries, or IBM i, the Clock Is the Same
IBM i 7.4 reaches end of standard support September 30, 2026 — the same day as Oracle JDK 17 Premier and FortiOS 7.2, and the day 7.3's first Service Extension window closes.
Compliance · Aug 2026
Is TLS 1.2 End of Life? No — the Full TLS Protocol Lifecycle: What Died in 2021, What Shipped in 2018, and What Compliance Actually Requires
TLS 1.2 is not end of life — no standards body has deprecated it, and NIST SP 800-52r2 and PCI DSS both permit it today. The dead versions are TLS 1.0 and 1.1: deprecated March 2021 by RFC 8996 (MUST NOT be used), removed from…
Risk Intelligence · Aug 2026
NetApp ONTAP End of Life: Every Version's Support Dates — and Why the Patch Cliff Comes Two Years Before "End of Support"
NetApp supports each ONTAP release for 3 years of full support — then 2 years of limited support that ships no patches of any kind. ONTAP 9.13.1 crossed the patch cliff June 30, 2026; 9.14.1 ends January 31, 2027;
OS · Aug 2026
Oracle Solaris End of Life: Sun Died in 2010, the Dates Run to 2037 — and the Real Deadline Is January 1, 2027
Oracle Solaris 11.4 is supported to November 2031 (Premier) and November 2037 (Extended) per Oracle's Lifetime Support Policy
Compliance · Aug 2026
How to Build a Software EOL Management Program (That Survives an Audit)
The software end-of-life management process in six steps, each built on our published research: inventory the six places EOL software hides (appliances, FROM lines, CI runners, cloud services, the RMM console itself) and the…
OS · Aug 2026
What Is the Latest Android Version? Android 17 — Every Version and Its Support Status
The latest Android version is Android 17 (Cinnamon Bun), released June 16, 2026. Android 14, 15, 16 and 17 still receive Google security patches; Android 13 and older do not. The complete table of all 34 Android versions
OS · Aug 2026
Proxmox VE 8 End of Life Is August 31, 2026 — the First Proxmox Deadline Most VMware Refugees Have Ever Faced
Proxmox VE 8 reaches end of life August 31, 2026 — no extended support, no LTS: Proxmox supports each release at least as long as its Debian base has Debian Security Team coverage, and Debian 12 crossed that line July 12, 2026.
OS · Aug 2026
Is RHEL 8.10 / 9.4 / 9.6 / 9.7 Still Supported? The Minor-Version Trap in Red Hat's 10-Year Lifecycle
RHEL 8 is supported until May 31, 2029 — and a RHEL 8.6 box has received zero patches since November 9, 2022 unless it carried EUS. Only the latest minor of each major (8.10, 9.8, 10.2) rides the standard patch stream;
OS · Aug 2026
RHEL 8・RHEL 9 のサポート期限はいつまで？RHEL ライフサイクル完全ガイド【2026年版】
RHEL 8 のサポート期限（メンテナンスサポート終了）は2029年5月31日、RHEL 9 は2032年5月31日。RHEL 7/8/9/10 の GA・フルサポート終了・EOL・ELS の日付を一覧表で整理し、最新マイナーリリースしかパッチを受け取れない「マイナーバージョンの罠」まで解説する日本語版 RHEL ライフサイクル完全ガイド。
Risk Intelligence · Aug 2026
Amazon EKS Version End of Life: 14 Months of Standard Support, Then the Bill Is the Notification — Every Version's Dates and the 6x Price
Amazon EKS supports each Kubernetes version for 14 months of standard support, then automatically enrolls clusters in extended support — no opt-in
Risk Intelligence · Aug 2026
Nutanix AOS 6.10 End of Life Is October 31, 2026 — the Last LTS Exits, and Its Maintenance Already Ended in January
Nutanix AOS 6.10 reaches End of Support Life October 31, 2026 — but its End of Maintenance already passed January 31, 2026, so the release has run on troubleshooting support with security fixes only for over six months.
Risk Intelligence · Aug 2026
MuleSoft's Support Treadmill: Mule 4.4 Has Been Fully Dead Since October — and 4.6 LTS Leaves Standard Support August 31
Mule 4.4 — the runtime the 2021–2023 integration build-out standardized on — lost Extended Support October 8, 2025, yet stays among the most-asked-about versions in our data.
Framework · Aug 2026
Zabbix End of Life: 7.4 Dies December 31, 6.0 LTS in February 2027 — Which Channel You Installed Decides Whether You Get Five Years or One
Zabbix 7.4 reaches end of life December 31, 2026. Zabbix 6.0 LTS gets critical fixes only until February 28, 2027, and Zabbix 5.0 has been dead since May 31, 2025. The LTS-vs-standard cadence trap
Risk Intelligence · Aug 2026
Atlassian's Two-Year Treadmill: Every Jira and Confluence Data Center Version Dies Two Years After Its Own Release — and the Server Ghost Fleet Keeps Getting Ransomed
Atlassian supports each Jira and Confluence Data Center release for exactly two years from its own release date — Jira 10.0 dies August 22, 2026, Confluence 9.0 already died July 30, 2026.
OS · Aug 2026
IBM AIX End of Life: "We Run 7.3" Is Not a Support Status — the Technology Level Clock, and the November 30 Deadline
AIX support expires per Technology Level, not per release: each TL gets fixes for 3 years per IBM's published policy. AIX 7.3 TL2 reaches End of Fix Support November 30, 2026, while TL3 runs to December 2027 and TL4 to December…
OS · Aug 2026
OpenShift 4.18 Maintenance Ends August 25, 2026 — Whether Patches Continue Depends on Your Subscription Tier
Red Hat OpenShift 4.18 exits maintenance support August 25, 2026. Patches don't stop for everyone: EUS continues to February 25, 2027 — included with Premium subscriptions, a paid add-on on Standard
Runtime · Aug 2026
Java 17's September 30, 2026 Deadline Is Oracle's, Not Java's — What Ends, What Already Ended, and Every Distribution's Real Date
September 30, 2026 ends Oracle Premier Support for JDK 17 — not free updates (Oracle's NFTC window closed September 2024) and not Java 17 itself.
Security · Aug 2026
GitLab 19.0 Stops Receiving Security Patches on August 20 — and GitLab's Whole Support Window Is 91 Days Wide
GitLab 19.0 leaves the security-patch window August 20, 2026 — 91 days after it shipped. GitLab patches only the current monthly release and the two before it, so "we upgraded recently" and "we're supported" are different claims:…
Framework · Aug 2026
FortiOS 7.2 End of Support Is September 30, 2026 — and FortiOS 7.0 Already Showed What Comes After
FortiOS 7.2 reaches End of Support September 30, 2026 — the end of even critical fixes, on a train that has been critical-fixes-only since engineering support ended March 31, 2025.
Risk Intelligence · Aug 2026
EOL 2026, the Mid-Year Report: The Year the Dates Got Dangerous — and Stopped Holding Still
The biggest end-of-life surprises of 2026 so far, every claim from a primary source: one in six vulnerabilities CISA confirmed as actively exploited this year is three-plus years old, FortiOS 7.0 became permanently unpatchable…
AI Models · Aug 2026
The Assistants API Dies August 26 — on Azure and OpenAI Both. What Breaks, and What Doesn’t Migrate
Both Microsoft and OpenAI retire the Assistants API on August 26, 2026 — Azure moves to Foundry Agents, OpenAI to the Responses + Conversations APIs.
Security · Aug 2026
Every Jenkins LTS Except the Newest Is Now Permanently Vulnerable — CVE-2026-70426
CVE-2026-70426, a critical deserialization bypass allowing remote code execution on the Jenkins controller, is fixed only in 2.576 and LTS 2.568.2. Under Jenkins’s rolling-LTS policy, every older LTS line — 2.555 and back
Security · Aug 2026
Quarkus Authorization Bypass (CVE-2026-39852): The Fix That 50+ EOL Versions Will Never Get
A CVSS 8.2 authorization bypass in Quarkus is fixed in current releases — but 55 of the 58 Quarkus release lines we track are past end of life, and the entire 2.x family will never see the patch.
Compliance · Aug 2026
Is Your MSP Billing You to Patch Software That Has No Patches?
CISA says attackers are exploiting N-able N-central right now — and legacy consoles can't take the fix until they migrate to a supported version first.
Risk Intelligence · Aug 2026
OpenEoX: Big Tech Is Standardizing Machine-Readable EOL Data — We Read the Draft and Filed Comments
Cisco, Microsoft, Oracle, Red Hat, IBM — with CISA and the NSA at the table — are writing OpenEoX, the OASIS standard for machine-readable end-of-life data. Public comment closes August 13.
OS · Aug 2026
Debian 11 Has 29 Days of Patches Left — and Bullseye Runs the Boxes Nobody Remembers
Debian 11 (Bullseye) LTS ends August 31, 2026 — after that, no free security updates at all; only paid Extended LTS (Freexian, listed through June 30, 2031) continues. Why five-year-old Bullseye installs are the forgotten ones
Security · Aug 2026
AWS Quietly Moved Lambda's Runtime Cutoffs to 2027. The Security Clock Didn't Move.
AWS pushed the operational blocks for its entire old-runtime cohort — Node.js 16/18/20, Python 3.8/3.9, Ruby 3.2, .NET 6 and provided.al2
Risk Intelligence · Aug 2026
Citrix Virtual Apps and Desktops 2203 End of Life: March 23, 2027 — LTSR Dates, Extended Support & Migration
Citrix Virtual Apps and Desktops 2203 LTSR reaches end of life March 23, 2027 — the end of its five-year mainstream window.
OS · Aug 2026
Horizon End of Life: Every VMware / Omnissa Horizon 8 Version's Support Dates
Horizon 7 is fully out of support since April 2025; Horizon 8 — now Omnissa Horizon — is alive, but every release runs a three-year clock. 2303, 2306 and the 2212 ESB all expired in 2026; 2309 ends October 26, 2026.
Framework · Jul 2026
Nuxt 3 End of Life: EOL Date, Risk, and Migration to Nuxt 4
Nuxt 3 reached end of life on July 31, 2026 after a six-month extension. Nuxt 3.21.10 was the final release. The EOL Risk Score, what stops shipping (including Nitro and h3), why Nuxt 4 has no fixed EOL date, and extended-support…
Database · Jul 2026
AWS Starts Charging for MySQL 8.0 on August 1. Here's What It Costs.
Amazon RDS for MySQL 8.0 reaches end of standard support July 31, 2026, and RDS Extended Support charges begin the next day. Enrollment is automatic unless it was explicitly disabled at instance creation.
Security · Jul 2026
The First AI-Run Ransomware Attack Used Zero Zero-Days
JADEPUFFER is the first ransomware intrusion documented as run end-to-end by an autonomous LLM agent. It needed no novel exploit: it entered through a Langflow flaw patched in March 2025, walked past a storage service still using…
OS · Jul 2026
RHEL 10 End of Life: Full Support to 2030, Maintenance to 2035 — Every Phase Dated
RHEL 10 (released May 20, 2025): full support ends May 31, 2030, maintenance ends May 31, 2035, ELS beyond. Every RHEL version's three lifecycle phases in one table, and the nearer deadline most teams miss
OS · Jul 2026
CentOS to RHEL: Version Mapping, Convert2RHEL, and When It's the Wrong Move
convert2rhel supports CentOS Linux 7.9 and 8.5 (and AlmaLinux/Rocky/Oracle Linux) — but NOT CentOS Stream. Which version lands where, the underrated CentOS 7 → RHEL 7 ELS play, and the cases where conversion is the wrong move.
Risk Intelligence · Jul 2026
IBM End-of-Life Dates: The Complete Enterprise Matrix
Every IBM enterprise end-of-support date in one place: z/OS 2.5 and IBM i 7.4 both die September 30, 2026, Db2 11.5 follows April 30, 2027, and AIX 7.3 TLs roll off from November 2026.
Security · Jul 2026
Exploited at CVSS 10.0 — and the Vendor Never Checked Whether EOL Versions Are Affected
Arista's advisory for the actively exploited VeloCloud Orchestrator flaw (CVE-2026-16812, CVSS 10.0) contains one line most readers skip: "End of support software versions have not been assessed." What that means if you run an…
Risk Intelligence · Jul 2026
CISA's 2026 Directives, Plainly: Patch by Risk (BOD 26-04) and Get EOL Off the Edge (BOD 26-02)
CISA now mandates risk-based patching (BOD 26-04: 3-day deadlines for exposed+exploited+automatable+total-control) and eviction of end-of-support edge devices (BOD 26-02).
Framework · Jul 2026
OpenSSL 3.0 End of Life: September 7, 2026 — What Actually Breaks, and What Doesn't
OpenSSL 3.0 dies September 7, 2026 — four days before EU CRA reporting begins. Who is actually exposed (bundled copies, not distro packages), the autumn EOL pile-up, and why 3.0→3.5 LTS is easier than feared.
Runtime · Jul 2026
Java End-of-Life Dates by Vendor: Why "When Does Java 17 Die?" Has Eight Different Answers
There is no single Java EOL date. Oracle JDK 17 Premier Support ends September 30, 2026 (Extended Support fee waived to September 2029), Oracle JDK 21's free-use updates end the same month, Red Hat's OpenJDK 8 ends November 30,…
Risk Intelligence · Jul 2026
Oracle Shipped 1,449 Patches. On Out-of-Support Versions, It Didn't Even Look.
Oracle's July 2026 Critical Patch Update is its largest ever — 1,449 security patches, roughly 1,235 unique CVEs. Oracle's own advisory says releases outside Premier or Extended Support are not tested for those vulnerabilities,…
Security · Jul 2026
The Next SharePoint 9.8 Arrived in Eight Days — CVE-2026-50522 Is Now Under Attack
CVE-2026-50522, a CVSS 9.8 SharePoint remote code execution flaw, went from public proof-of-concept to active exploitation and onto CISA's Known Exploited Vulnerabilities list on July 22, 2026.
OS · Jul 2026
Android End of Life: Every Version's Support Status and EOL Date
Android 13 reached end of life March 2, 2026 — Android 14, 15, 16 and 17 remain supported. The complete Android version EOL table, how Google's security bulletins work, and why your device's clock differs from the OS clock.
AI Models · Jul 2026
Samsung Galaxy End of Life: The Complete EOL List, Model by Model
The complete Samsung Galaxy end-of-life list: all 437 tracked devices with release and security-update end dates — S series, foldables, Note, A/M/F/J and more. 323 are already past end of support; recent flagships get 7 years.
OS · Jul 2026
macOS End of Life: Every Version, and Apple's Unwritten Support Rule
Apple supports the current macOS plus two — macOS 13 Ventura died September 15, 2025. Every macOS version's EOL date, the unwritten September rule, and the Intel Mac hardware catch.
OS · Jul 2026
iOS End of Life: Which iPhone and iPad Versions Still Get Updates
Apple publishes no iOS lifecycle calendar — patches just stop. iOS 26 and 18 are fully supported; iOS 15/16 get unpredictable emergency fixes; iOS 12's final patch came January 2026. Every version's dates.
Risk Intelligence · Jul 2026
Microsoft Office End of Life: 2016 and 2019 Are Dead, 2021 Dies in October
Office 2016 and 2019 both hit end of support October 14, 2025. Office 2021 dies October 13, 2026 — the same day Windows 10's first commercial ESU year ends. Every Office release's dates, and why there is no ESU for Office.
AI Models · Jul 2026
iPad End of Life: How Long Every Model Gets Updates
iPads get updates for 5–8 years, but Apple never announces the end date — support follows the chip, and models die in cohorts. Every iPad model's status and when to retire it from sensitive use.
OS · Jul 2026
Oracle Linux End of Life: Premier vs Extended Support, Every Version
Oracle Linux 7 left premier support December 31, 2024 — extended support runs to June 2028. OL8 to July 2029, OL9 to June 2032. Every version's dates and why Oracle's clock differs from RHEL's.
Risk Intelligence · Jul 2026
Splunk End of Life: The Two-Year Clock on Every Version
Splunk Enterprise versions get almost exactly two years of support. 9.3 dies July 24, 2026; 9.4 follows December 16, 2026 — then all of 9.x is gone. Every version's dates and how to live with the two-year clock.
Database · Jul 2026
IBM Db2 End of Life: 11.5's 2027 Deadline and Every Version's Dates
Db2 11.5 — the version most estates run — dies April 30, 2027, and Db2 12.1 is the only successor. Every version's dates, IBM's predictable April-30 rhythm, and why 2026 is the assessment year.
Framework · Jul 2026
PostgreSQL 14 End of Life: November 12, 2026 — the Clock Is Running
PostgreSQL 14 dies November 12, 2026 — no more security or data-corruption fixes, per the exact five-year November rhythm. Every version's dates, why to target 16/17 not 15, and what to do if November is impossible.
Framework · Jul 2026
Magento Release History and End of Life: Every Version, Every Date
Magento 2.4.9 (May 12, 2026) is the current version. 2.4.6 lost standard support August 11, 2026, and 2.4.5's extended window closed August 12.
AI Models · Jul 2026
Microsoft Surface End of Life: Every Model's Drop-Dead Date
Microsoft publishes an exact end-of-servicing date for every Surface — about six years per model. Every device's date, the firmware-vs-Windows distinction, and the Windows 10 double cutoff.
OS · Jul 2026
Windows Server End of Life: Every Version's Dates, the October 13 Double Deadline, and 2016's January Cliff
Windows Server 2012/R2's final ESU year and Windows Server 2022's mainstream support both end October 13, 2026; Windows Server 2016 reaches end of extended support January 12, 2027.
OS · Jul 2026
Debian 11 End of Life: The August 31 LTS Cutoff, and What "End" Actually Means
Debian 11 Bullseye's LTS ends August 31, 2026. The three support tiers explained (standard, LTS, paid ELTS), why upgrading to 12 buys less than it sounds, and the container FROM-line catch.
Compliance · Jul 2026
Your Docker Base Images Are Quietly Dead: The FROM-Line Audit Nobody Runs
debian:10, ubuntu:20.04, node:18-alpine — these tags still pull and build, but the OS inside stopped getting security patches.
Security · Jul 2026
SharePoint's Last Patch Ever Fixed a Flaw Already Under Attack — and It Shipped on the Day Support Ended
On July 14, 2026 SharePoint Server 2016 and 2019 reached end of support — the same day Microsoft patched CVE-2026-58644, a CVSS 9.8 remote code execution flaw already exploited in the wild.
Risk Intelligence · Jul 2026
AWS Is Quietly Retiring 20+ Services. The Door Closes July 30. Here's the Full List.
AWS's June 30 announcement is its largest coordinated service retirement ever: ~20 services including Kendra, Q Business and Bedrock Agents Classic close to new customers July 30, 2026;
Risk Intelligence · Jul 2026
EOL Dates Drift: What We Found Cross-Checking 54 Products Against Their Vendors
Original research: we cross-checked 54 products against official vendor lifecycle documentation. 33 verified exactly, 12 dates corrected, 7 products have no vendor-published dates at all
Security · Jul 2026
Gold Eagle Can't Patch What Nobody Maintains: The EOL Hole in the White House's New Vulnerability Pipeline
The White House's Gold Eagle clearinghouse launched July 14 to coordinate AI-discovered vulnerabilities at machine speed — 35,364 CVEs landed in H1 2026 alone.
Risk Intelligence · Jul 2026
EOL Dates Were Written for Humans. Their Next Reader Is a Machine.
Open source EOL dates are becoming machine-read infrastructure: AI agents query them, regulators mandate them, insurers underwrite on them. What AI actually changes about software lifecycles — and what it can't
Compliance · Jul 2026
The EU Cyber Resilience Act Has an EOL Problem — and the Clock Started in 2024
The CRA's vulnerability reporting obligations begin September 11, 2026 — over a year before the main obligations everyone plans around.
Compliance · Jul 2026
NIS2 and End-of-Life Software: The Patching Obligation You Can't Meet With Dead Components
NIS2 requires vulnerability handling — but an end-of-life component has no patches to apply. What the directive asks of essential and important entities, why EOL software breaks it, and the management-accountability angle that…
Compliance · Jul 2026
DORA Names Legacy Systems Directly: What Financial Entities Must Do About End-of-Life ICT
DORA has applied since January 17, 2025 — and it names legacy ICT systems explicitly. Why end-of-life components are the purest form of the risk it regulates, and the lifecycle process a financial entity's ICT risk framework can…
Runtime · Jul 2026
Java Support Deadlines and the Oracle Licensing Trap: What Actually Runs Out, and When
Oracle JDK 8 support ended March 2022, JDK 11 in September 2023, and JDK 17 loses support September 30, 2026. How Oracle's per-employee licensing turned old Java into audit exposure, and the OpenJDK escape path.
Risk Intelligence · Jul 2026
The H2 2026 EOL Pileup: Seven Major Deadlines in Six Months
OpenSSL 3.0, Oracle JDK 17, Windows Server 2012 ESU, Python 3.10, .NET 8 and 9, PostgreSQL 14, and PHP 8.2 all reach end of life between September and December 2026.
Risk Intelligence · Jul 2026
The Cyber-Insurance Question You Can't Answer: Do You Run Unsupported Software?
Cyber-insurance questionnaires increasingly ask about end-of-life software — and most organizations genuinely don't know their answer.
Risk Intelligence · Jul 2026
The Software Lifespan Study: We Measured 7,144 Versions — the Median Lives 18 Months
Original research from the endoflife.ai dataset: across 463 products and 7,144 versions, the median supported lifespan is just 1.5 years.
OS · Jul 2026
How to Migrate Off Windows 10: The Post-EOL Playbook (2026)
Windows 10 reached end of life October 14, 2025, and consumer Extended Security Updates run only to October 2026. The migration paths to Windows 11 — hardware checks, in-place upgrade, and what to do with ineligible machines.
OS · Jul 2026
CentOS 7 Migration Guide: Your Options in 2026
CentOS 7 reached end of life June 30, 2024. Two years on, the realistic paths: in-place conversion to Rocky Linux or AlmaLinux, a move to RHEL, or extended support while you plan the migration.
Runtime · Jul 2026
Migrating Off PHP 7: A Practical Upgrade Path to 8.x
PHP 7.4 reached end of life November 28, 2022, yet PHP 7 still runs across production. The practical upgrade path to PHP 8.x — breaking changes, tooling, and how to sequence the jump.
Runtime · Jul 2026
Node.js 18 End of Life: Upgrade Guide to 20/22 LTS
Node.js 18 reached end of life April 30, 2025 — no more security patches. The upgrade guide to Node.js 20 and 22 LTS: what breaks, what to test, and how to move safely.
Framework · Jul 2026
AngularJS Is Long Dead: Migration Options That Actually Work in 2026
AngularJS reached end of life December 31, 2021. The migration options that actually work in 2026 — incremental rewrites to Angular, moving to another framework, and extended support as a bridge.
OS · Jul 2026
Exchange Server 2016 & 2019: Every Deadline Has Now Passed
Exchange 2016 and 2019 ended extended support October 14, 2025, and the last ESU window closes in 2026 with Microsoft stating no further extensions.
Runtime · Jul 2026
.NET 8 and .NET 9 Both Die November 10, 2026 — The Double Cutoff
.NET 8 (LTS) and .NET 9 (STS) reach end of support on the same day: November 10, 2026. The support-model math behind the collision, what ends, and why .NET 10 is the only forward target.
OS · Jul 2026
Windows Server 2012 & 2012 R2 End of Life: The Final ESU Deadline Is October 13, 2026
Windows Server 2012/2012 R2 reached end of life October 10, 2023, and the last ESU year ends October 13, 2026 — on-premises and on Azure alike. Every verified date, the ESU track table, and the 2019/2022/2025 migration decision.
OS · Jul 2026
VMware ESXi & vSphere End of Life in the Broadcom Era: Every Support Date
vSphere 7.x general support ended October 2, 2025, perpetual licenses are gone, and every ESXi version now runs on a subscription clock.
OS · Jun 2026
Ubuntu 25.10 End of Life: July 1, 2026 — What to Do Now That the Deadline Has Passed
Ubuntu 25.10 (Questing Quokka) reached end of life on July 1, 2026. No more security patches since that date. Upgrade path, who is affected, and everything to do before the deadline.
Runtime · Apr 2026
Node.js 14 End of Life — April 30, 2023: Are You Still Running It?
Node.js 14 reached end of life April 30, 2023. No more CVE patches, no security fixes. Your risk score, the vulnerabilities you are exposed to, and how to upgrade.
Runtime · Feb 2026
PHP 7 and Node.js 16: The Ghost Versions Still Running in Production
PHP 7.x and Node.js 16 are still running on millions of production servers years after EOL. What that means for your security posture.
EOL — Dec 31, 2022
Bootstrap End of Life — EOL Dates & the jQuery Problem
Bootstrap 5 is maintained; Bootstrap 2, 3, and 4 are all EOL — and Bootstrap 3/4 drag end-of-life jQuery (and its known XSS) along with them. Every version's EOL date, the real risk, and the path to Bootstrap 5.
EOL — LTS cadence
Ember.js End of Life — The LTS Cadence & Every EOL Date
Ember 6.4 LTS reached EOL June 21, 2026; everything 5.x and earlier — including the common 3.28 LTS — is end of life. The LTS schedule, the Octane shift that stranded 3.x apps, and the ember-cli-update path.
Is jQuery dead?
jQuery End of Life — What's Actually EOL (and What Isn't)
jQuery core isn't dead — but jQuery 1.x/2.x got no updates since 2016, jQuery UI hit EOL Aug 5 2024, and any jQuery below 3.5.0 ships known XSS CVEs. The honest breakdown and the fix via jQuery Migrate.
EOL — every 6 months
Angular End of Life — The 18-Month Treadmill & Every EOL Date
Angular 19 reached EOL May 18, 2026 — only 20 and 21 are supported. Why Angular apps fall behind faster than any framework, every version's EOL date and Risk Score, the ng update path, and extended support for stranded apps.
EOL — Dec 31, 2023
Vue 2 End of Life — Risk & Migration to Vue 3
Vue 2 reached EOL December 31, 2023 — no more security patches. Every version's EOL date and Risk Score, why client-side EOL is a real threat, the Vue 3 migration path via @vue/compat, and extended-support options.
New · 2026 Reference
Software EOL Dates 2026 — The 100+ Most-Searched Versions in One Reference
Every date that matters in one page: 124 versions across 44 products — Windows, Ubuntu, Debian, RHEL, Node.js, Python, PHP, Java, PostgreSQL, Kubernetes, Spring Boot, and more. Regenerated at every deploy.
EOL — Nov 10, 2026
.NET End-of-Life Dates — .NET 8 & 9 Both EOL November 10, 2026
.NET 8 is LTS — but LTS is only 3 years, and it reaches EOL the same day as .NET 9. .NET 6 and 7 are already dead. The full schedule, the LTS-vs-STS trap, and the migration path to .NET 10.
New · Start Here
What Is EOL Software? Every Term, Acronym & Concept Explained
The plain-English foundation: what EOL, EOS, LTS, and CVE actually mean, what runtimes, frameworks, and libraries are, how version numbers work, and why support dates matter — assuming zero prior knowledge.
EOL Watch · July 14 Triple Cutoff
SharePoint 2016 & 2019 End of Life — and SQL Server 2016 Joins Them
Three Microsoft server products reached end of support on one day: July 14, 2026. No ESU for SharePoint, paid ESU terms for SQL Server 2016 to 2029, and the options table for on-prem shops with no perpetual-license version left to hop to.
EOL Watch · All Coverage
EOL Watch: every deadline we've covered
The full news section — day-of coverage of every major software end-of-life event, verified against vendor lifecycle sources. SharePoint, SQL Server, Windows Server, VMware, .NET, Exchange and more.
EOL Watch · SQL Server 2016 deep-dive →
SQL Server 2016 End of Life: The ESU Runway to 2029
Support ended July 14, 2026. The full breakdown: the three-year ESU decision math, the Azure Arc / Software Assurance purchase mechanics, the editions that get nothing (Express, Web, Developer), and every migration path.
EOL Watch
Debian 12 Regular Support Ended — Your Real Situation
Bookworm's regular security support ended July 12, 2026; LTS runs to June 30, 2028. What stops today, the Debian LTS coverage trap, the Debian 11 double-deadline seven weeks out, and your three paths forward — ranked honestly.
EOL Watch · June 30 Wave
Four Spring Projects Went EOL on One Day
Spring Boot 3.5, Framework 6.2, Security 6.5, and Cloud 2025.0 all left open-source support on June 30 — and 3.5 was the last 3.x release. Why the whole stack ends at once, and what teams on 3.x do now.
New · Start Here
What Is a CVE? Vulnerability IDs, CVSS, KEV & EPSS Explained
CVEs are recall notices for software. Who assigns the IDs, what CVSS scores really mean (and how they mislead), why CISA's KEV list outranks everything, the hour-by-hour life of a CVE — and why EOL software turns them into permanent exposure.
New · Start Here
Runtime vs Framework vs Library CVEs — Why the Layer Changes Everything
The same CVSS score, three different emergencies. How Struts broke Equifax, why Spring4Shell punished EOL stragglers, what Log4Shell taught everyone about transitive dependencies — and who actually ships the fix at each layer of your stack.
New · Start Here
What Is LTS? Long-Term Support Explained — Windows, Rhythms & the Trap
LTS promises a defined window, not immortality. The release rhythms of Node, Java, Ubuntu, and .NET, why vendors split their release trains, the planning mistake that catches almost everyone — and how to upgrade in calm instead of panic.
New · Start Here
What Is a Dependency? Transitive Packages, Lockfiles & SBOMs Explained
Modern software is mostly other people's software. How one manifest line becomes a thousand packages on disk, what lockfiles actually record, the day eleven lines of code broke the internet — and the one-hour question Log4Shell taught everyone to answer.
New · Start Here
The Day After EOL — What Actually Happens When Software Support Ends
Nothing crashes on day zero — that's the trap. The real timeline of an EOL system: the vulnerability backlog, the ecosystem moving on, the compliance clock, and the four exits ranked by when to take them.
New · AI Model Lifecycle
GPT-3.5 Turbo Retirement — OpenAI Deprecation Dates & What Replaces It
GPT-3.5 Turbo is legacy: snapshot 0613 retired Sep 2024, 0301 deprecated Jun 2023. The retirement timeline, the GPT-4o mini migration checklist, and why model shutdowns are the EOL events of the AI stack.
AI Deprecation Timeline
AI Model Deprecation Dates 2026 — OpenAI, Gemini, Llama & Mistral
GPT-4 Turbo, Gemini 2.0, Llama 3, Mistral Large — all deprecated or on a countdown. The complete 2026 AI model deprecation timeline with exact shutdown dates, tracked across all four major providers.
EOL — May 2025
ROS Noetic End of Life — ROS 1 Is Over: Migration Guide to ROS 2
Noetic was the final ROS 1 distribution — its EOL ended the entire ROS 1 line. What that means for long-lived robot fleets, the double-EOL problem with Ubuntu 20.04, and the ros1_bridge migration path.
New · Product Update
Your EOL Dates Are Deadlines — Now They Live on Your Calendar
Add any product's end-of-life date to your calendar with reminders 90, 30 & 7 days out — and why PCI DSS, ISO 27001, SOC 2, HIPAA, NIST, and CISA all treat that lead time as a control, not a nicety.
Incident Guide
My Software Is EOL — What Do I Do Now?
Just found out your software is end-of-life? Understand your actual risk, the CVE blind spot your scanner is missing, and your four options — migrate, extended support, compensating controls, or risk acceptance.
⚠ EOL — Now in Effect
Debian 12 Bookworm EOL July 11, 2026 — What You Need to Do Now
Debian 12 reached end of life June 10. Who is at risk, the Docker base image checklist, compliance implications, and your step-by-step upgrade path to Debian 13 or LTS coverage.
Live Tool · CISA KEV
CVE Intelligence — EOL Software with Active CISA KEV Exposure
Every product in the CISA Known Exploited Vulnerabilities catalog cross-referenced against EOL status. Live Risk Scores, sortable by urgency. The CVE blind spot made visible.
EOL — April 30, 2025
Node.js 18 End of Life: Which Vendors Offer Extended Security Support?
Node.js 18 is end of life. No patches since April 2025. Compare extended lifecycle support vendors extended lifecycle support options — CVE coverage, compliance docs, and contract terms.
EOL — Dec 31, 2026
PHP 8.2 End of Life: December 31, 2026 — Migration Guide & Extended Support
PHP 8.2 is in security-only support until Dec 31, 2026. See the exact date, upgrade path to PHP 8.3, live countdown, and which vendors cover PHP 8.2 after end of life.
Ubuntu 20.04 EOL
Ubuntu End of Life Dates 2026 — Which Vendors Offer Extended Security Support?
Ubuntu 20.04 is already EOL. Ubuntu 22.04 reaches end of standard support April 2027. Full EOL date table and extended lifecycle support vendor comparison: Canonical ESM and third-party ELS vendors.
Operating System
Debian EOL Dates — Official Lifecycle Schedule for Every Version
Debian 12 regular support ends July 11, 2026. Debian 11 LTS ends June 30. All three support phases — regular, LTS, and ELTS — explained with EOL Risk Scores and migration guidance for every version.
Operating System
RHEL End-of-Life Dates — Official EOL Schedule for Every Version
RHEL 7 fully EOL since June 2024. RHEL 8 in Maintenance Support until 2029. Full Support, Maintenance, Extended Life, and ELS phases explained with EOL Risk Scores.
Framework
Django End-of-Life Dates — Official EOL Schedule for Every Version
Django 4.2 LTS reached EOL April 7, 2026. LTS vs standard releases explained, Python compatibility matrix, EOL Risk Scores, and a step-by-step upgrade guide.
Database
PostgreSQL End-of-Life Dates — Official EOL Schedule for Every Version
PostgreSQL 14 reaches EOL November 12, 2026 — and 13 is already past it. The predictable 5-year policy explained, EOL Risk Scores, and a pg_upgrade migration guide.
Database
MySQL End-of-Life Dates — Official EOL Schedule for Every Version
MySQL 8.0 reached EOL April 30, 2026 — the default MySQL for 8 years. Innovation vs LTS explained, EOL Risk Scores, and a step-by-step upgrade guide.
Database
MariaDB End-of-Life Dates — Official EOL Schedule for Every Version
MariaDB 10.6 LTS reaches EOL July 6, 2026. LTS vs rolling releases explained, EOL Risk Scores, and a step-by-step upgrade guide.
Database
Oracle Database End-of-Life Dates — Premier & Extended Support for Every Version
Oracle 19c Premier Support runs to Dec 2029 (Extended to 2032). 18c, 12c, and 11g are all past support. Lifetime Support phases explained — plus the Sustaining Support CVE blind spot.
Framework
AngularJS End of Life — The Framework Died Dec 31, 2021
Every AngularJS version (1.0–1.8) reached EOL on the same day and there's no 1.9. The real risk level, AngularJS vs Angular, migration paths, and extended support options.
Framework
React End-of-Life Dates — What's Actually Supported in 2026
Meta doesn't publish hard React EOL dates. React 18 is security-only. React 17 and 16 are unsupported. Here's what that means and how to upgrade.
Infrastructure
Kubernetes End-of-Life Dates — Official EOL Schedule for Every Version
K8s 1.32 is EOL. K8s 1.33 reaches end of life June 28, 2026. Official dates, EOL Risk Scores, EKS/GKE/AKS support windows, and a step-by-step upgrade guide.
Compliance
Hidden Compliance Risks from Unsupported Software
SOC 2, PCI DSS, HIPAA, and ISO 27001 all share one quiet vulnerability: unsupported software. Here's what your auditors will find — before you do.
Compliance
Your EOL Dependencies Are a Compliance Problem — Not Just Tech Debt
That outdated Node or Python version isn't just a "we should upgrade someday" item. If your company is going through SOC 2, PCI, or HIPAA, it's a finding waiting to happen.
Runtime
PHP End-of-Life Dates — Official EOL Schedule for Every Version
PHP 7.4, 8.0, and 8.1 are all currently EOL. PHP powers 77% of the web — making EOL PHP one of the most widespread security risks in the ecosystem. Official dates, scores, and migration guidance.
Framework
Spring Framework End-of-Life Dates — Official EOL Schedule for Every Version
Spring 5.3, 6.0, and 6.1 are all currently EOL. Three major versions unpatched simultaneously. Official dates, EOL Risk Scores, and migration guidance for every version.
Framework
Spring Boot End-of-Life Dates — Every Version EOL Guide (2.x, 3.x and 4.x)
Spring Boot 4.0 is current. Spring Boot 3.4 OSS support ended December 2025. Spring Boot 2.7 OSS ended June 2023 with commercial support to June 2029. Full dates, Java requirements, and migration guidance.
Networking
Cisco IOS XE End-of-Life Dates — Full Version EOL & EoS Guide (17.x)
IOS XE 17.9 and earlier are end of life. 17.15 is the current Long-Lived release. Full release train EOL dates, Standard vs Long-Lived explained, and upgrade commands for Catalyst 9000.
Security
The Security Blind Spot Nobody Is Talking About Enough
EOL software gets a clean bill of health from every CVE scanner. Here's why that's the most dangerous gap in enterprise security — and what we built to close it.
Runtime
Node.js End-of-Life Dates — Official EOL Schedule for Every Version
Node.js 14, 16, 18, and 20 are all EOL. Official dates, EOL Risk Scores, breaking changes, and a 5-step migration guide for every version.
Runtime
Python End-of-Life Dates — Official EOL Schedule for Every Version
Python 3.10 and 3.11 both reach EOL on October 31, 2026. Official dates, EOL Risk Scores, and migration guidance for every Python version.
Risk Intelligence
The EOL Risk Score: Why CISOs and DevOps Teams Are Measuring Software Risk Wrong
Your vulnerability scanner gives EOL packages a clean bill of health. That silence is not safety — it is a measurement failure. Here is the metric that fills the gap.
Risk Intelligence
The EOL Risk Score™ Explained: What It Is, How It Works, and Why It Matters
A deep explainer on the EOL Risk Score™ — the five signals behind the score, how to read the bands, real-world use cases for security teams, DevOps, CISOs, and auditors.
2026 EOL Report
The Top 50 Products Reaching End of Life in 2026
The definitive list — 50 products, exact dates, CVE risk ratings, and migration guidance. Updated quarterly.
Security
The CVE Blind Spot: Why EOL Software Is More Dangerous Than a Zero-Day
With a zero-day, nobody knows. With EOL software, the attacker knows and you don't. Here's why that asymmetry is the most dangerous gap in enterprise security.
IT Security
Windows 10 End of Life: The Complete Migration Guide for IT Teams
Windows 10 reached EOL October 14, 2025. Millions of enterprise machines are running unpatched. Here is what you need to do now.
Open Source
The 2026 EOL Calendar: Every Major Runtime and Framework
Python, Node.js, PHP, Ruby, Java LTS — every major platform support window in one place, updated quarterly.
Enterprise
The Hidden Cost of Running EOL Software: A CISO's Risk Framework
Unsupported software is not just technical debt. It is a material security risk. Here is how to quantify it and present it to your board.
Hardware
EOSL for Enterprise Hardware: Cisco, HPE, Dell EMC Timelines
When your storage arrays and network gear hit end-of-service-life, the security clock starts. A vendor-by-vendor breakdown of critical dates.
Compliance
Why Your EOL Risk Score Is the Most Important Number in Your Security Stack
What the EOL Risk Score™ measures, how it maps to SOC 2, ISO 27001, and PCI DSS, and the real-world consequences — Equifax, MOVEit, Log4Shell — of ignoring it.
EOL — Dec 31, 2025
Apache Tomcat End of Life: Tomcat 9 EOL, Migration to Tomcat 10/11
Tomcat 9 reached end of life December 31, 2025. The javax.* to jakarta.* namespace break is why teams stay stuck. EOL Risk Scores for every Tomcat version and a step-by-step migration guide.
EOL — Feb 1, 2025
Veeam Backup & Replication End of Life: Version EOL Dates & Compliance Risk
Veeam 11 is EOL. Veeam 12.0 is EOL. Running unsupported backup software means unpatched CVEs and potential audit findings under SOC 2, PCI DSS, and ISO 27001.
All Versions EOL
CentOS End of Life: CentOS 7 & 8 Are EOL — Migration to AlmaLinux, Rocky, RHEL
CentOS 7 EOL June 2024. CentOS 8 EOL December 2021. No supported CentOS Linux versions remain. Migration options, in-place conversion tools, and EOL Risk Scores for every version.
EOL — Apr 1, 2025
Ruby on Rails End of Life: Every Version EOL Date & Upgrade Guide
Rails 6.1 EOL June 2024. Rails 7.0 EOL April 2025. Only Rails 7.1, 7.2, and 8.0 receive patches today. EOL Risk Scores and the Rails maintenance policy explained.
EOL — Apr 2026
Apache Kafka End of Life: Version EOL Dates & KRaft Migration Guide
Kafka releases EOL every 4 months. Kafka 3.6 reached EOL April 2026. EOL dates and Risk Scores for every Kafka version, plus the ZooKeeper deprecation and KRaft migration guide.
Developer API — Live
Integrate EOL intelligence into your stack
Query lifecycle data programmatically. Built for CI/CD pipelines, SBOMs, security scanners, and dependency tooling. Free tier available.
Get API Key →
Free · Pro $199/mo · Enterprise custom
Know before your scanner does
The Monthly EOL Digest™
Once a month — the most critical end-of-life dates, CVE blind spots, and lifecycle changes worth knowing about. Curated from endoflife.date, vendor advisories, and CISA KEV. Signal, not noise.
Monthly cadence. AI-curated, human-reviewed. Unsubscribe anytime. We never sell your data.