The 2026 EOL Calendar: Every End-of-Life Date Left This Year

By Scott Bissett  ·  Updated: November 2026  ·  242 dated events from 2026-08 through year end, drawn nightly from vendor lifecycle policies across 700+ tracked products — methodology

Between August 1 and December 31, 2026, we count 805 dated end-of-support events across the software world — and an unusual share of them are giants. OpenSSL 3.0. Oracle JDK 17's Premier Support. Windows Server 2012's final ESU year. Python 3.10. .NET 8 and 9 on the same day. PostgreSQL 14. Debian 11. PHP 8.2. The five months ahead are the densest stretch of major retirements in recent memory — and September 11 drops the EU Cyber Resilience Act's reporting obligations into the middle of it.

The year so far (January–July): what already fell

2026's first seven months set the tone. April 30 was a double funeral — Node.js 20 and MySQL 8.0 on the same day, two defaults of the last decade retiring together. Elasticsearch 7 opened the year (January 15), Ubuntu 16.04's decade of ESM coverage closed April 2, Ruby 3.2 and Django 4.2 LTS fell in the spring, Spring Boot 3.5 in June — and July delivered the one-two of Debian 12 leaving standard support (July 11) and SharePoint 2016/2019's final patches (July 14), the latter arriving the same day as an actively exploited CVE (that story).

August 2026 — 146 tracked end-of-support events

The headline: Debian 11 "Bullseye" LTS ends August 31 — the last free security updates for a release still running enormous fleets (our deadline guide). Rails 7.2 goes end-of-life August 9, ESLint 9 on August 6, and the entire Proxmox 8 family (VE, Backup Server, Mail Gateway) retires August 31.

September 2026 — 174 tracked end-of-support events

The pivotal month of the year. OpenSSL 3.0 LTS — the crypto library inside everything — dies September 7 (what actually breaks and what doesn't). Four days later, on September 11, the EU Cyber Resilience Act's vulnerability-reporting obligations switch on (the CRA × EOL collision). And on September 30, Oracle JDK 17 leaves Premier Support — the pay/switch/upgrade decision for every Oracle-licensed Java estate (the vendor-by-vendor matrix). The same day retires FortiOS 7.2, IBM i 7.4 and FreeBSD 15.0 — a quietly brutal enterprise cluster. Firefox 140 ESR ends September 29.

October 2026 — 196 tracked end-of-support events

October 13 is the biggest single date on the calendar: Windows Server 2012 and 2012 R2 exhaust their final Extended Security Update year — after this there is no next ESU to buy (the ESU cliff, explained). The same Patch Tuesday ends Windows 11 24H2 Home & Pro. Python 3.10 reached end of life on October 1, 2026, OpenSSL 3.4 on October 22, 2026, and Kubernetes 1.34 on October 27, 2026. October 7 is the other cluster: five AWS services end support the same day — Amazon FinSpace, Amazon Lookout for Equipment, AWS IoT Greengrass V1, AWS Proton and AWS WAF Classic — all announced on the same day a year earlier under AWS's standard twelve-month sunset (the five-service shutdown, explained).

November 2026 — 113 tracked end-of-support events

November 10 is a double .NET funeral: .NET 8 (LTS) and .NET 9 (STS) die the same day (the .NET 8 guide) — alongside Windows 11 23H2 Enterprise. PostgreSQL 14 follows on November 12 (migration guide), OpenSSL 3.6 on November 1, Angular 20 on November 28, and on November 30 Red Hat's Java 8 build exits support inside RHEL — the nearest cliff for the JVM's most stubborn version (Java by vendor).

December 2026 — 176 tracked end-of-support events

PHP 8.2 receives its last security fix December 31 — closing the year the way it opened, with a massive install base crossing the line at once (PHP versions guide). By New Year's Eve, everything above plus roughly sixty quieter retirements will have landed.

The pattern in the pile

Three threads run through this calendar. First, the infrastructure layer is retiring in sync: OpenSSL's 3.0/3.4/3.6 lines, Windows Server 2012's last ESU, and the JDK deadlines all land within eleven weeks of each other — estates that treat these as separate projects will do the same inventory work three times. Second, "end of life" increasingly means "end of the paid extension": 2012's ESU cliff and Oracle's Premier-to-Extended handoff are lifecycle events for money, not code. Third, the CRA changes what these dates cost: from September 11, an EOL component inside a product sold in the EU is a reporting liability, not just a risk (our CRA analysis).

Getting ahead of it

1. Inventory once, against the whole calendar — paste your stack into the Stack Scanner and it flags everything on this page that applies to you.
2. Sort by hard-cliff vs soft-cliff: Windows Server 2012 (no next ESU) and OpenSSL bundled copies are hard; anything with a commercial extension market is schedulable.
3. For the estates that can't migrate in time, extended support exists for most of the big names on this page — compare the options before the deadline, not after.

Frequently Asked Questions