Every end-of-life guide, newest first.

VMware Tools 12.0 reaches end of service March 1, 2027, and its last build has no fix for exploited CVE-2025-41244. Dates for every 12.x and 13.x line.

BeyondTrust ends support for perpetual licences of Remote Support, Privileged Remote Access, Password Safe and EPM on December 31, 2026. What changes.

Cisco Firepower 4110 reaches its Last Date of Support January 31, 2027; signature updates stop the same day. Dates for the 4100 series and what to do.

Cisco stops selling the ISR 1100 C1112, C1113, C1116, C1117, C1131 and C1161 on January 31, 2027. Support runs to 2032; security fixes end sooner.

Cisco Viptela SD-WAN 19.1 and 19.3 reach their Last Date of Support February 28, 2027. Security fixes for both ended in 2022. Dates and what to do.

Cisco Unified Communications Manager 14 reaches its Last Date of Support April 30, 2027. Software maintenance has already ended; version 15 replaces it.

Citrix Workspace app for Windows 2402 LTSR reaches end of life April 8, 2027. Maintenance already ended. Dates for 2507.1 and 2607 LTSR, and what to do.

Infinispan 13.0 and 15.2 both leave support in November 2026, on Infinispan's own table. 14.0 runs to October 2027. Upgrade paths and options.

Microsoft JDBC Driver 10.2 for SQL Server leaves mainstream support January 31, 2027, and Microsoft offers no extended support for it. What to do.

RabbitMQ 4.3 leaves community support January 31, 2027. Commercial support is listed to April 30, 2028. Dates for 4.2, 4.3 and 4.4, and what to do.

Redis 6.2 reaches end of life April 1, 2027 on Redis's version page. Upgrade targets 7.2, 7.4 and 8.2, and the licence change after 7.2, explained.

Visual Studio 2017 (version 15.9) leaves Microsoft's extended support on April 13, 2027. Build Tools and Remote Tools 2017 end with it. What to move to.

Paid RDS Extended Support for PostgreSQL 11 ends March 31, 2027, then AWS upgrades the engine itself. Standard support ended February 29, 2024. What to do.

Cisco stopped AnyConnect 4.x patches on March 31, 2024 and ends all support on March 31, 2027. AnyConnect is in CISA KEV. The move to Cisco Secure Client.

WatchGuard ends development and support for Firebox T15, T15-W, T35-R and T35-DW on March 1, 2027. Firebox is in the CISA KEV catalog. Dates, what to do.

Palo Alto Networks ends Cortex XDR agent 9.2 support on February 28, 2027 and 9.1 on November 22, 2026. Why agent releases last 9 months, and what to do.

Cyber Essentials requires all in-scope software to be licensed and supported, removed or isolated in an offline sub-set when it is not, and patched within 14 days for critical and high-risk fixes. How ESU, sub-sets and Cyber Essentials Plus testing work, and how to build the evidence.

The HIPAA Security Rule names no product and has no blanket ban on old software. Its required risk analysis and risk management make an unsupported system a documented, treated risk. What each specification says, what OCR has said about legacy systems, medical devices, the proposed update, and how to build the evidence.

Section 500.13(a) of 23 NYCRR Part 500 requires the asset inventory to track each asset's owner, location, classification, support expiration date and recovery time objective. Who it applies to and from when, how unsupported systems flow into the risk assessment, vulnerability management, the CISO report and the April 15 filing, and the evidence to keep.

PCI DSS does not ban end-of-life software by name. Requirement 12.3.4 asks for a yearly review that documents vendor end-of-life announcements and a remediation plan approved by senior management; 6.3.3 asks for critical patches within one month. The evidence an assessor examines, a worked example, and how to automate it.

IBM ends fixes for HashiCorp Vault 1.20 on October 31, 2026. Vault 1.21 and 1.19 LTS get fixes until April 30, 2027. IBM's own dates, and what to do.

Java 17 Supportende: 30. September 2026. Oracle JDK 21: Supportende 30. September 2028. Oracle Java Lizenz pro Mitarbeiter und der Weg zu OpenJDK.

Licence Oracle Java : fin de support Java 17 le 30 septembre 2026. Oracle JDK 21 passe sous licence OTN au CPU d'octobre 2026. Dates et options.

Wie lange wird Office 2024 noch unterstützt? Bis zum 9. Oktober 2029, ebenso Office LTSC 2024: fünf Jahre, kein erweiterter Support. Dazu 2021 und 2019.

Office 2024 et Office LTSC 2024 : fin de support le 9 octobre 2029, après cinq ans, sans support étendu. Comparaison avec 2021, 2019 et Microsoft 365.

SQL Server 2016 Supportende am 14. Juli 2026, SQL Server 2017 Supportende am 12. Oktober 2027, SQL Server 2019 Supportende am 8. Januar 2030.

SQL Server 2016 : fin de support le 14 juillet 2026. SQL Server 2019 : fin de support le 8 janvier 2030. Cycle de vie SQL Server, versions 2012 à 2025.

Windows Server 2016 Supportende: 12. Januar 2027. Windows Server 2019 Supportende: 9. Januar 2029. Alle Versionen, ESU und Upgrade-Pfade.

Windows Server 2016 : fin de support le 12 janvier 2027. Windows Server 2019 : fin de support le 9 janvier 2029. Dates 2012 R2, 2022 et 2025.

AEM 6.5 core support ends February 28, 2027 and extended support February 28, 2028; Adobe continues the line as AEM 6.5 LTS. Adobe's own dates.

NX-OS 10.3 reaches End of Security Support and Last Date of Support on February 28, 2027, the day 10.5 moves to security fixes only. Cisco's dates.

F5 ends software support for 15 BIG-IP iSeries platforms and the 10350v FIPS on January 1, 2027: no CVE patches after that day. F5's K4309 dates.

Node2Shell (CVE-2026-111497), a Brotli flaw, is fixed in Node.js 22.23.4, 24.22.1 and 26.12.1. End-of-life Node 20 and 18 get no official fix.

D-Link DSR-150 VPN router Last Day of Support: December 31, 2026, per D-Link's Legacy Products list. Sibling DSR dates, KEV status, what to do.

NixOS 26.05 end of life date: December 31, 2026, after seven months of bugfixes and security updates. Release dates, 25.11, and how to upgrade.

PHP2Shell (CVE-2026-109618, CVE-2026-109619): fixed releases 8.5.12, 8.4.27, 8.3.36, 8.2.35. No 8.1 release; source-only patches for 7.4, 8.0 and 8.1.

Oracle's October 2026 CPU has 1,295 patches per Oracle's advisory. Which versions were patched, which past-support versions got none, and next dates.

HPE Aruba Networking 8320 bundles JL479A, JL579A and JL581A End of Sale date: November 30, 2026; End of Support Life November 30, 2031. Replacements.

Cisco UCS 6454 and 64108 Fabric Interconnect End-of-Sale date: December 22, 2026; Last Date of Support: December 31, 2031 (EOL15931). Migration parts.

An EOL date is the last day a software version gets fixes, including security patches. What it covers, how to look one up for any product, and live dates.

EOL means end of life. The EOL full form is end of life: the date a software maker stops publishing fixes, including security patches. EOL vs EOS vs EOSL.

Fortinet End of Support: FortiGate-60E on December 29, 2026; FortiAnalyzer-800F, 3000F and FortiManager-300F on December 30, 2026. January 2027 rows.

FreeBSD 14.4-RELEASE expected end of life: December 31, 2026. FreeBSD 14 branch (stable/14): November 30, 2028. FreeBSD 14.5: June 30, 2027.

Liferay DXP 2025.Q4 End of Premium Support date: November 25, 2026, with no Limited Support phase. The quarterly release rule and where to move.

OpenLDAP 2.5 end of life date: January 15, 2027; critical fixes only until then, at the Project's discretion. 2.6 is the LTS release to move to.

Red Hat AMQ Broker 7 Full Support end date: December 31, 2026; Maintenance Support to April 30, 2028; ELS to November 30, 2030. What each phase covers.

Red Hat build of Keycloak 26.6 Full Support end date: November 15, 2026; 26.4 Maintenance Support end date: December 3, 2026. What each phase covers.

Red Hat Ceph Storage 7 End of Life date: December 12, 2026, the end of Production Support; the ELS add-on runs to August 31, 2029. Not upstream Ceph.

Red Hat Data Grid 8.6 Full Support end date: December 31, 2026; Maintenance Support to December 31, 2027; ELS to 2030 and 2033. Data Grid 8.5 has ended.

HPE Aruba IAP-325, IAP-335, 2530 8G and 2540 24G PoE+ reach End of Support October 31, 2026; MSR3044 and MSR3024 leave sale that day.

Lifecycle dates from October 20 to 31, 2026: Node.js 24 to Maintenance, Azure Communication Services and AWS sign-up limits, Cisco, Red Hat, Aruba.

Streams for Apache Kafka 2.9 (AMQ Streams) end of life: October 31, 2026. The last ZooKeeper release; Red Hat requires KRaft before 3.x.

Acronis Cyber Protect 16 Mainstream Support end date: October 28, 2026. Extended Support end date: October 28, 2027. What each phase still covers.

Cisco Catalyst 3650 Last Date of Support: October 31, 2026, the same day security fixes end (EOL14617). Every milestone, and the Catalyst 9300 path.

Fortinet End of Order and End of Support dates from October 29, 2026 to November 14, 2026: FortiGate-81E, FortiAuthenticator-2000E and seven more.

GoAnywhere MFT 7.8 General Support end date: November 12, 2026; Partial Support end date: May 12, 2027, per Fortra. What changes, and the KEV history.

Microsoft Host Integration Server 2016 extended support end date: January 11, 2027, a day before Windows Server 2016. What ends, and HIS 2020.

Kentico Xperience 13 end of technical support: December 31, 2026. Security hotfixes only until then, nothing after. The KEV flaws and the upgrade path.

Sitecore 10.0 and 10.1 Extended Support end date: December 31, 2026. Sustaining Support follows to the end of 2028. What changes, and the June 2026 policy.

Hazelcast Platform 5.3 Extended Support ends November 19, 2026, per Hazelcast's support table. Patches stopped May 19, 2025. Supported lines, upgrade path.

Juniper EX4300-48MP and EX4600 last order date: December 29, 2026. End of Engineering is December 29, 2029; End of Support, December 29, 2031.

Oracle Access Management, Identity Governance, Unified Directory and Internet Directory 12c (12.2.1.x) leave Premier Support on December 31, 2026.

Microsoft ends support for Windows Server 2016, .NET Framework 4.6.2, System Center 2016, BizTalk 2016 and more on January 11 and 12, 2027.

The Meraki MX84 reached End-of-Support on October 31, 2026; the MS450-12 left sale on October 29, 2026. Every 2026 and 2027 date, in Meraki's terms.

Confluent Platform 8.1.x Community support end date October 15, 2026, Standard October 15, 2027, Platinum October 15, 2028. Every release's three dates.

PHP 8.2, Spring Boot 4.0, Oracle WebLogic 12.2, Office Online Server and Nutanix AOS 7.0 all end on December 31, 2026. Every row, grouped by what to do.

Dynamics 365 Business Central on-premises version 26 end date: October 13, 2026 under Microsoft's Modern Lifecycle Policy. End dates for 29 to 13.

Java 8 has no one EOL date. Red Hat OpenJDK 8 full support ends November 30, 2026; Oracle, Temurin, Corretto, Zulu, IBM run to at least December 2030.

Progress moves MOVEit Transfer 2025.1 to Sunset on November 18, 2026: no service packs or hot fixes after that. 2025.0 is Retired the same day.

Oracle Fusion Middleware 12c (12.2.1.x) Premier Support ends December 31, 2026 for WebLogic, Forms, HTTP Server, SOA, ADF; Extended to December 31, 2027.

Serv-U 15.5.1 ends November 18, 2026; Platform 2023.3 and 2023.4 November 20, 2026; Web Help Desk 12.4 to 12.8 November 30, 2026. All in CISA's KEV.

SonicWall NSM On-Prem 3.2.0, 3.2.1, 3.5.0 and 4.0.0 reach Support Discontinued on October 30, 2026; 4.0.0 enters Limited Support on October 28, 2026.

Umbraco 13 LTS reaches end of life on December 14, 2026, per Umbraco's LTS schedule. Security fixes only since December 14, 2025; move to Umbraco 17.

Windows 11 25H2 Home and Pro reach end of support on October 12, 2027; Enterprise and Education on October 10, 2028. What ends, and the move to 26H2.

Arista EOS 4.31.x End of Support date: October 13, 2026 under Arista's 36-month policy. Where 4.30 to 4.36 stand, and the exploited flaw with no fix.

Windows Update certificates expire in 2027. Server 2016, Server 2019 and Windows 10 Enterprise 2019 LTSC need the July 2026 update before May 17, 2027.

Progress moved WS_FTP Server 9.0 from Active to Sunset on October 23, 2026, with no service packs or hot fixes after that; Retired on April 23, 2027.

Alpine Linux 3.21 reached end of support on November 1, 2026, per Alpine's release branches page. What it means for alpine:3.21 images and how to upgrade.

Advisory AA26-281A (CISA, FBI, NSA and seven partners, October 8, 2026): eight old CVEs in end-of-life software, and the fix is replacement, not patching.

Cloudera platform 7.3.1 reaches End of Support on December 31, 2026, per Cloudera's support lifecycle policy. What it means and the upgrade path to 7.3.2.

DuckDB 1.4 LTS ends November 17, 2026, per DuckDB's release calendar, and 1.5 now runs to March 1, 2027. What changed and how to upgrade.

Kiali has no end-of-life dates of its own: a version is supported while its Istio is. Kiali 2.21 to 2.25 ended with Istio 1.29 on October 15, 2026.

Nutanix Files 5.3 reaches End of Maintenance on November 30, 2026 and End of Support Life on August 31, 2027, per Nutanix. What changes and how to plan.

Rocket.Chat 8.3 and 8.4 reach end of life on October 31, 2026, per Rocket.Chat's Version Durability matrix. What stops working and how to upgrade.

Silverstripe CMS 6.1 reached end of life on October 18, 2026, per Silverstripe's support timeline. What Partial support meant and how to move to 6.2.

ansible-core 2.19 end of life is November 30, 2026 (the project prints Nov 2026). Security fixes only; ansible-core vs ansible package dates and Python.

FortiNAC 9.4 end of support is November 13, 2026. Engineering support ended May 13, 2025, per Fortinet's product life cycle page. Every 8.x and 9.x branch.

HashiCorp Consul 1.22 and Nomad 1.11 reach end of support on October 31, 2026, the day printed in HashiCorp's own support tables. Where to upgrade.

QNAP ES1686dc, ES2486dc, TDS-16489U R2 and TS-2888X end Technical Support and Security Updates on December 31, 2026, per QNAP's product status page.

Red Hat Satellite 6.19 leaves Full Support in November 2026 (Red Hat estimate). 6.17 Maintenance Support ends November 28, 2026; 6.16 ended May 31, 2026.

SUSE Linux Micro 5.3 end of general support is October 30, 2026, per SUSE's lifecycle page. Dates for 5.4, 5.5, 6.0 and 6.1, and SUSE's upgrade path.

Zerto 10.8 bug fixes ended October 28, 2026 and end of support life is October 28, 2027, per HPE Zerto's lifecycle matrix. Also 10.0 Update 6 and 10.9.

Atlassian's CVE-2026-21589 advisory names fixed builds only on LTS and newest lines; other supported Jira, Confluence, Bitbucket and Bamboo lines get none.

On September 29, 2026 AWS sunset Managed Blockchain, DevOps Guru, Backint for SAP ASE and Infrastructure Composer; new customers blocked October 29, 2026.

Electron 42 reached end of life on October 20, 2026, the day Electron 45 went stable. Only the latest three stable majors get fixes: 43, 44 and 45.

Microsoft Office 2024 と Office LTSC 2024（Professional Plus・Standard）のサポート期限は2029年10月9日。延長サポートはありません。Office 2021・LTSC 2021・2019 の期限も一覧で整理した日本語ガイド。

PowerShell 7.4 (LTS) and 7.5 both reach end of support on November 10, 2026, the day .NET 8 and .NET 9 end. Upgrade to PowerShell 7.6, the current LTS.

Redis 8.0 end of life is December 1, 2026, per Redis's version management page. It is a Standard release; Redis 8.2 is the Extended release to move to.

Windows 11 24H2 のサポート期限は Home/Pro が2026年10月13日、Enterprise/Education が2027年10月12日。21H2〜26H2 全バージョンの終了日と「サポート終了」の意味、25H2 への更新方法を日本語で整理。

Windows Server 2016 の延長サポート終了日は2027年1月12日、2022 のメインストリームサポート終了日は2026年10月13日。2019・2025・2012 R2 の期限と ESU を一覧で整理した日本語ガイド。

How Red Hat supports RHEL: ten-year life cycle, Full and Maintenance Support phases, ELS and EUS add-ons, what a subscription buys, how to check yours.

RHEL 8 end of life is May 31, 2029, the end of Maintenance Support. Full Support ended May 31, 2024; the paid ELS add-on can run to May 31, 2033.

SQL Server 2019 end of support is January 8, 2030. Mainstream support ended February 28, 2025, so it gets security fixes only until then.

SQL Server 2022 end of support is January 11, 2033. Mainstream support runs until January 11, 2028; after that it gets security fixes only.

Windows Server 2016 ESU gives security updates for up to three years after January 12, 2027, through 2030. Who qualifies and how it is bought.

Windows Server 2025 end of life is November 14, 2034. Mainstream support ends November 13, 2029; after that it gets security updates only.

FortiMail CVE-2026-104286 is being exploited. Fortinet now names the fixed builds 8.0.2, 7.6.7 and 7.4.9; the 7.2 branch gets an upgrade path, not a fix.

Apache Pulsar 4.0 LTS active support ended October 21, 2026; security patches continue until October 21, 2027. What each window means.

Ceph Squid (19.2) estimated end of life: October 31, 2026, per Ceph's own release index, about 24 months after release. What stops, and the Tentacle date.

CockroachDB v24.1 reached end of life on October 21, 2026, when Assistance Support ended; Maintenance Support ended October 21, 2025. Where to go next.

Fedora Linux 43 reaches end of life on December 1, 2026, four weeks after Fedora 45 shipped. What end of life means and the upgrade path.

FortiAuthenticator 6.6 reaches End of Engineering Support on December 11, 2026 and End of Support on June 11, 2028. What each date means, plus 6.5 and 8.0.

Office Online Server retires December 31, 2026 with no on-premises successor. What stops, what breaks in SharePoint and Exchange, and Microsoft's answer.

RHEL 9 life cycle: full support ends May 31, 2027, maintenance May 31, 2032, ELCP to May 31, 2036. What each Red Hat phase delivers, which minors qualify.

Office 2019 end of life was October 14, 2025, the same day as Office 2016. What stopped, why there is no paid extension, and where to move.

The Axios security policy lists the whole 0.x line as supported, but every 0.x fix in its 2026 advisories shipped as a new 0.x release rather than a backport, most recently 0.34.0. One advisory lists 0.x versions as vulnerable with only a 1.x fix. What that means for code pinned to an older 0.x minor, and the commercial 0.x support HeroDevs announced with the Axios project.

On September 30, 2026 Anthropic deprecated claude-sonnet-4-5-20250929 with a retirement date of November 30, 2026 and claude-sonnet-5-5 as the recommended replacement. What deprecation and retirement mean on the Claude API, why the September 29 floor was never a retirement date, the 61-day window, and where Haiku 4.5 and Opus 4.5 stand.

Full Support for Red Hat JBoss Web Server 6 ends on November 30, 2026 according to Red Hat's Product Life Cycle data; Maintenance Support runs to November 30, 2028 and Extended Life Cycle Support 1 to November 30, 2031. What each Red Hat phase covers, the five-year standard life cycle behind the dates, the Apache Tomcat line inside JWS 7, 6 and 5, and what to do before the phase changes.

Qt 6.10 reached the end of its standard support on October 7, 2026 according to The Qt Company's own supported-versions table. Qt 6.11 runs to March 17, 2027 and Qt 6.8 LTS to October 8, 2029. The one-year rule for standard support, the five-year rule for LTS since 6.8, the open-source rule that patch releases stop when the next minor ships, and what Extended Support means.

On September 22, 2026 CISA added four actively exploited vulnerabilities in one batch: Arista VeloCloud Orchestrator, F5 BIG-IP APM and two in Check Point, all due for federal remediation by September 25, 2026. All three vendors' advisories stop at the end-of-support line, in their own words: Check Point labels seven affected releases EoS with no fix, F5 evaluates only versions before End of Technical Support, Arista limits fixes to release trains under support. What each carve-out means and what to do this week.

Istio 1.29 reached end of life on October 15, 2026 under the project's N+2 support policy, the date Istio's supported-releases table and its final 1.29.9 release notes give. What stopped on that day, what the six 2026 security bulletins fixed in the 1.29 line, the Kubernetes versions each supported minor is tested on, the Envoy 1.36 date one day earlier, and the move to 1.30 or 1.31.

Amazon FinSpace, Amazon Lookout for Equipment, AWS IoT Greengrass V1, AWS Proton and AWS WAF Classic all reached end of support on October 7, 2026 - announced together on October 7, 2025 under AWS's standard twelve-month sunset. Proton's own FAQ says all data is deleted after the date. What stops for each, what AWS names as the migration target, and why no third party can sell extended support for a managed service.

GKE supports each Kubernetes minor version for about 14 months of standard support and up to 24 months with the Extended channel. Kubernetes 1.34 on GKE reaches the end of standard support on January 25, 2027 and the end of extended support on November 25, 2027. Google's schedule for 1.32 to 1.36, the two support periods, auto-upgrade and the Extended channel fee, explained.

How RHEL 8, 9 and 10 and OpenShift 4.16 to 5.0 lifecycle phases are read daily from Red Hat's Product Life Cycle Data API, reconciled against upstream and human decisions, and served with source and verification day through the REST API and the MCP server validated on RHEL 9 and 10. Full tables, one annotated response, batch and MCP use, keys and limits.

A worked example: a seven-component CycloneDX SBOM sent to POST /v1/sbom?enrich=1 and returned with end-of-life dates, support status, EOL Risk Scores and CISA KEV exposure on every component it recognises, with the source and verification day of each date. What the response says about a vulnerable-but-supported line, an untracked version and an untracked package, and how SPDX differs.

Windows 11, version 24H2 end of support dates: October 13, 2026 for Home and Pro and October 12, 2027 for Enterprise and Education, per Microsoft's lifecycle pages. What stopped on the date, why there is no ESU for a feature update, and why the move to 25H2 is an enablement package rather than a reinstall.

IBM ended support for the last ProtecTIER models, the TS7650G (3958-DD6) and TS7620, on November 30, 2020. Every model and version, with IBM's dates.

Windows Server 2022 end of life (EOL) and end of support: October 14, 2031. End of mainstream support: October 13, 2026; from then on, security fixes only.

AKS supports three Kubernetes minor versions at a time. Kubernetes 1.34 on AKS ends in November 2026. Microsoft's calendar for 1.32 to 1.36, explained.

Amazon Corretto 26 end of life: October 2026; its last planned update was in July. Corretto 25 is supported to October 2032. Full calendar.

Cisco IOS XR 7.8 gets its last security fixes on November 30, 2026, and support ends May 31, 2027. Cisco's milestones explained, with other XR releases.

Cisco ISE 3.1 and 3.2 got their last software fixes on November 3, 2026, and support ends November 30, 2027. Cisco's milestones explained.

Confluence 7.13 was released August 17, 2021 as a Long Term Support release and reached end of life August 17, 2023. Every 7.13.x release, dated.

DrayTek Vigor2960 firmware maintenance ends December 9, 2026. The Vigor3900 and Vigor300B are already end of life. All three are on CISA's exploited list.

CVSS rates how severe one vulnerability is. The EOL Risk Score rates how risky one software version is to keep running. How they differ and work together.

EPSS estimates if a CVE will be exploited in the next 30 days. KEV lists CVEs already exploited. The EOL Risk Score rates a version's lifecycle risk.

FortiGate のファームウェア FortiOS 各バージョンのエンジニアリングサポート終了日とサポート終了日を、Fortinet の製品ライフサイクル情報に基づいて一覧で整理した日本語ガイド。7.2 のサポート終了と、7.4・7.6・8.0 への移行先の期限も解説します。

Joomla 5 stopped getting bug fixes on October 13, 2026; security fixes end October 12, 2027. What changes on each date and when to move to Joomla 6.

LibreOffice 26.2 reaches end of life on November 30, 2026, and 25.8 already has. How long each LibreOffice version lasts and what businesses should run.

Metabase 63 reached end of life on November 1, 2026. Ordinary Metabase versions last about two months; the LTS version lasts 14. Every date, explained.

Microsoft 365 Apps version 2607 reaches end of service on November 10, 2026. How long a version is supported on each update channel, and the 2026 change.

An SBOM lists components and versions, not support dates. What CycloneDX and SPDX can carry about end of life, and how to add lifecycle data to an SBOM.

Apache Spark 4.0 reaches end of life on November 23, 2026. From Spark 4.3 most releases are maintained for only 6 months. Dates for 3.5, 4.0, 4.1 and 4.2.

Australia's cyber agency says legacy technology will be first to fall in a major AI-enabled attack. What ASD counts as legacy, and how to find yours.

Azul's support roadmap now lists paid Legacy Production Support for Java 6 and Java 7 to December 2029, two years later than before. What it covers.

Checkmk 2.3 reached end of life on October 29, 2026, when passive maintenance ended. Active maintenance ended November 6, 2025. Dates for 2.3, 2.4 and 2.5.

FortiOS 7.4 reaches End of Engineering Support on May 11, 2027 and End of Support on November 11, 2028. What each date means, plus 7.2, 7.6 and 8.0.

Apple never announces an iPhone end-of-life date. This chart shows which models run iOS 27, which get security fixes only, and which get nothing.

Microsoft Edge versions get security updates only while they are the latest: two weeks on Stable since version 152, eight on Extended Stable. The rules.

Microsoft Office 2024 and Office LTSC 2024 are supported until October 9, 2029: five years, no extended support. How that compares with 2021, 2019 and 365.

Python 3.10 reaches end of life in October 2026. It has been security-only since April 2023. What stops, which versions are supported, and where to move.

An application delivery controller has two end-of-life clocks, the appliance and the firmware. NetScaler MPX and SDX hardware end dates with the replacement platforms Citrix names in its own notices, NetScaler ADC firmware milestones, and F5 BIG-IP and FortiADC software end dates, with what to do in order.

Angular LTS is the 12-month security-fix phase after active support. Angular 20 leaves it on November 28, 2026. Dates for every supported version.

Adobe ColdFusion 2021 core support ended November 10, 2025 and extended support ends November 10, 2026. Every ColdFusion version's dates from Adobe's own support matrix, and where to move.

kernel.org projects end of life for the 5.10 and 5.15 longterm kernels in December 2026. Every longterm branch and its projected date, CVE-2026-98432 (the IPv4 TCP flaw fixed on 5.10 and 5.15 but with no 4.19 or 5.4 release, and who scored it what), who the kernel.org date applies to (custom builds, embedded devices, appliances, vendor device kernels) and who it does not (distribution kernels follow the distribution), with the three kernel flaws CISA added to its exploited list on September 18, 2026.

Next.js 15 end of life is January 31, 2027: Vercel extended Maintenance LTS past October 21, 2026. What it still gets, and moving to Next.js 16.

Microsoft Office 2021 end of support date: October 13, 2026, and Office LTSC 2021 ended the same day. What stopped, which editions, and where to move.

Oracle Database 19c・21c・26ai の Premier Support と Extended Support の終了日、サポートが終了した 12c・18c の日付を、Oracle の Lifetime Support Policy に基づいて一覧で整理した日本語ガイド。19c の Java 8 関連の除外、23ai から 26ai への名称変更も解説します。

PHP 7.4 から 8.5 までのアクティブサポートとセキュリティサポートの終了日を、php.net の公表値に基づいて一覧で整理した日本語ガイド。2年間のアクティブサポートと2年間のセキュリティサポートという仕組み、OS 同梱の PHP との違いも解説します。

Rancher 2.11 reached end of life on October 24, 2026; its maintenance ended October 24, 2025. SUSE's dates for every Rancher 2.x line and where to move.

Spring Boot 2.7 から 4.1 までの OSS サポートと商用サポートの終了日を一覧で整理した日本語ガイド。3.5 の OSS サポートはすでに終了。最終マイナーバージョンに商用サポートが5年間追加される Spring のサポートポリシーと、2.x・3.x からの移行の考え方も解説します。

Microsoft SQL Server end-of-life dates for every version from 2012 to 2025: mainstream support, extended support and Extended Security Updates in one table, the service-pack trap that gives SQL Server 2016 and older the wrong date, and what to do by version.

Ubuntu LTS 各バージョン（26.04・24.04・22.04・20.04・18.04）の標準サポートと Ubuntu Pro（ESM）の終了日を、Canonical の公表値に基づいて一覧で整理した日本語ガイド。標準サポート中でも universe は ESM の対象である点、中間リリースの9か月サポートも解説します。

Windows Server 2016 end of life (EOL) and end of support is January 12, 2027. Paid Extended Security Updates run through 2030. Dates, ESU and upgrades.

Windows Server 2019 end of life (EOL) and end of support: January 9, 2029. Mainstream support ended January 9, 2024; security fixes only until then.

CISA listed Cisco ISE CVE-2026-76460, an unauthenticated API bypass of the management interface at CVSS 10.0 and exploited in the wild, on September 16, 2026 with a September 19, 2026 deadline and a forensic-triage flag. Cisco shipped one patch per train from 3.1 to 3.5 and none for 3.0. On the Cisco lifecycle bulletin, 3.1 and 3.2 are in their security-only phase: the last fix ships on November 3, 2026 and support ends on November 30, 2027.

Three IBM support clocks stopped on September 30, 2026: z/OS 2.5 left standard support on IBM's product lifecycle list, IBM i 7.4 left standard support with a paid Service Extension to September 30, 2029, and Semeru Runtime 26 retired. The upgrade targets for each, what IBM offers after the date, and the IBM deadlines that are not this year: AIX 7.3 TL2 on November 30, 2026, Db2 11.5 on April 30, 2027 and MQ 9.3 on September 30, 2027.

AWS never shipped a managed .NET 5 Lambda runtime; .NET 5 was container-only and AWS deprecated it on May 10, 2022, the day Microsoft ended .NET 5 support. The live deadline is .NET 8, deprecated on November 10, 2026 with updates blocked from August 31, 2027. All eight .NET runtimes, three AWS dates each, against Microsoft's own.

CISA listed Cisco Secure Email Gateway CVE-2026-76461, an unauthenticated SQL injection to root from one crafted email, on September 14, 2026 with a September 17, 2026 deadline and a forensic-triage flag. Fixed builds for 15.5, 16.0 and 16.5; none for 15.0 though it is inside Cisco's security support to April 30, 2027; 14.x and older are outside Cisco's lifecycle table.

Sonatype's Nexus Repository 3 Versions Status page carries 3.79 as Extended Maintenance with a sunset of October 1, 2026; under Sonatype's Software Support Policy a sunsetted release has no support obligations. A line sunsets every month; the calendar and the upgrade target.

Cisco fixed eight exploited Catalyst SD-WAN flaws on the 20.9 line in 2026, the last on September 30, the final day of its End of Vulnerability/Security Support window. After that, Cisco's bulletin says fixes may go to later lines only.

CISA added CVE-2026-85706, a CVSS 10.0 unauthenticated path traversal in GitLab's repository commits API, to its Known Exploited Vulnerabilities catalog on September 11, 2026 with a September 14 deadline. GitLab fixed 19.3.2, 19.2.6 and 19.1.8, then on September 23 backported the fix to 19.0.9 and 18.11.12; 18.10, 18.9, 18.8 and 18.7 still have no fixed build. GitLab 19.1 left security support on September 17, 2026.

Cisco's CVSS 10.0 Firewall Management Center authentication bypass is exploited by three groups, Talos said the day CISA listed it. Hot fixes cover 7.0, 7.2, 7.4, 7.6, 7.7 and 10.0. FMC 7.3 left security support on May 18, 2026 and 7.1 on December 21, 2024; neither appears in the advisory.

CISA added CVE-2026-86060 and CVE-2026-67277 to its Known Exploited Vulnerabilities catalog on September 10, 2026 with a September 13 deadline. CERT Polska's vulnerable range for both runs from RouterOS 6.0.0 to below 6.49.21, and MikroTik fixed 6.x only on the 6.49 line, in 6.49.21 and every later release: 6.48 and every earlier 6.x line has no fixed build. On 7.x the fixes are 7.23.4 on the long-term channel and 7.24.2 on stable.

Microsoft extended Windows 10 consumer Extended Security Updates to October 12, 2027 with an editor's note on June 25, 2026, not an announcement. Most trackers, and four of our own pages, kept saying October 2026 for 76 days. How a lifecycle date drifts, what the record September 2026 Patch Tuesday (966 fixes, two exploited zero-days) means for an unenrolled Windows 10 PC, and the build-time check that now verifies the date against Microsoft's page.

CVE-2026-75650, a CVSS 10.0 unauthenticated remote code execution flaw in Adobe Commerce and Magento Open Source, exploited since September 4 and in CISA's KEV catalog since September 8. Adobe shipped a hotfix for Commerce 2.4.4 through 2.4.9 under a security-only period; Magento Open Source's affected list stops at 2.4.6. Your version decides whether a fix exists, with every support date verified against Adobe's lifecycle table.

AWS did not merely end support for App Mesh on September 30, 2026: the console and every mesh resource became inaccessible. What the notice says, who is affected, and the two migration paths AWS names - Amazon ECS Service Connect for ECS and Amazon VPC Lattice for EKS.

RHEL 8 : fin de support le 31 mai 2029. RHEL 9 : fin de support le 31 mai 2032. RHEL 10 : fin de support le 31 mai 2035. RHEL 7 : fin de vie le 30 juin 2024 (ELS RHEL 7 jusqu'au 31 mai 2029). Les dates GA, fin du support complet, EOL et ELS de chaque version, l'ELS et l'EUS, et le piège des versions mineures qui ne reçoivent plus de correctifs.

On November 10, 2026, .NET 8 (LTS) and .NET 9 both reach end of life, PowerShell 7.4 (LTS) and 7.5 end the same day, and Windows 11 23H2 Enterprise and Education stops being serviced. What ends, what does not, and the order to fix it in.

Firefox 140 ESR reached end of life on September 29, 2026; Firefox 153 ESR (released July 21, 2026) is the replacement, and 115 ESR stays patched for older Windows and macOS through March 2027. Every Firefox ESR line with release and end-of-life dates, how the ESR cycle and its overlap work, and what a managed fleet has to do when patches stop.

An SBOM lists what you ship; it does not say whether any of it is still supported. How to join CycloneDX and SPDX components to lifecycle data by package URL (exact) instead of by name (a guess), what endoflife.ai's purl map covers by ecosystem, and what happened when we ran four real GitHub-exported SBOMs — Strapi, Grafana, n8n, Keycloak; 21,347 components — through the check: 42 tracked lines, 11 past end of life, 21,305 honestly reported as not tracked. Three ways to run it: the API, the GitHub Action, the Stack Scanner.

Cisco's Small Business RV routers hit their Last Date of Support in two waves: RV160, RV160W, RV260, RV260W, RV260P, RV340W and RV345P reached it on September 30, 2026, and RV340 and RV345 reach it on October 31, 2026. Security fixes stopped in 2022, Cisco names no replacement, and the older RV016/RV042/RV082/RV320/RV325 carry an exploited flaw Cisco says it will never patch.

Exchange Web Services in Exchange Online: phased disablement started October 1, 2026 and EWS is fully and permanently disabled April 1, 2027, with no exceptions. The end-of-August opt-out window has passed. How the EWSEnabled switch and AppID Allow List work, what Microsoft Graph still cannot do, why on-premises Exchange is unaffected but hybrid is not, and the four-week checklist.

Moodle 5.0's security support ended October 5, 2026; general support ended April 20, 2026. On the same day Moodle 5.1 left general support and runs security-only to April 19, 2027, while the older 4.5 LTS is supported to October 4, 2027. Every version's dates from Moodle's releases page, why summer-2025 upgraders are the exposed population, and a four-week checklist for self-hosted and university sites.

Coverage in early September 2026 said NetScaler ADC firmware 13.1 would reach end of life on September 15, 2026. The vendor's release-cycle article CTX241500 says otherwise: 13.1 reached End of Maintenance on September 15, 2026 and reaches End of Life on September 15, 2027. What the technical-support-only year means, the NetScaler Console 13.1 date (April 15, 2026) that gets conflated with it, the CitrixBleed context, and the checklist for a 13.1 estate.

Cisco's ASA 5506-X, 5508-X and 5516-X reached their Last Date of Support on August 31, 2026, a year after the 5525-X, 5545-X and 5555-X. The verified bulletin milestones for every ASA 5500-X model, the fourteen ASA entries in CISA's KEV catalog including one added three weeks ago, and Cisco's stated migration path.

CISA has confirmed exploitation of CVE-2026-82329, a CVSS 9.8 authentication bypass to administrator in JFrog Artifactory, with a federal due date of September 5, 2026. JFrog fixed all six supported branches on August 28. The branches past end of life, 7.104 and older, appear in neither the affected nor the fixed list, and the lowest fixed branch itself ends on October 23.

SonicWall's Gen 6 firewalls reached End of Support in two waves: TZ400, TZ600, NSA 3600 and NSa 3650 on August 1, 2026, and TZ350, TZ500, SOHO 250, NSA 4600 to 6600 and NSa 4650 to 6650 on October 1, 2026. The verified dates, the firmware that stopped in 2024, the KEV record, and Gen 7's own last-order dates.

SonicWall confirms active exploitation of two SMA 1000 vulnerabilities, one a CVSS 10.0 pre-authentication SSRF, and CISA has given federal agencies until September 5, 2026. The affected builds, the fixed hotfixes, the six SMA 1000 KEV entries since January 2025, and where the past-support SMA 6200 and 7200 stand.

Seven CISA KEV entries share an unusual required action: not patch - disconnect. D-Link routers end-of-life since 2017 and Zyxel DSL gateways 'EOL for years' keep landing in the exploited catalog, one almost seven years after the vendor's last patch. The fix column on D-Link's own advisory reads 'Not Available.' Dates read at the vendor.

FortiManager 7.2 End of Support date: October 11, 2026, per Fortinet's own lifecycle portal - and engineering support already ended April 2025. This is the product line behind the actively exploited FortiJump flaw (CVE-2024-47575), on the device that holds credentials and configs for every FortiGate it manages. 7.0 and 7.2 are past EOS; the path is 7.4 or 7.6.

Ivanti's ISA6000 and ISA8000 appliances reach end of support and end of life on January 31, 2027 - the hardware under the most-exploited VPN in CISA's KEV catalog. The same day, no Connect Secure 22.x release is supported on any hardware. The verified dates, the DDR4 reason, the virtual appliances caught in it, and the migration path.

There is no industry standard — EOS and EOL mean whatever each vendor says they mean. The decoder: what Microsoft, Red Hat, Cisco, Oracle, Canonical, Fortinet, PHP, Python, CISA and vendors that publish nothing actually mean, the four-phase model underneath every vocabulary, live examples from tracked data, the special cases (end of sale, SaaS retirement, EOSL, de facto EOL), and the one date that belongs in your risk register.

ICS 22.7, 22.8 and the 25.1.0-25.1.2 releases all reach End of Support on January 31, 2027 - days before BOD 26-02's twelve-month decommission deadline lands in early February. The 9.x precedent (exploitation confirmed on the end-of-support line) shows what the collision means; the N-2 treadmill and the ISA hardware catch shape the plan.

CVE-2026-82078 and CVE-2026-81578 chain into pre-auth RCE against PaperCut NG/MF, on CISA's KEV since August 31, 2026 with a September 14 federal deadline. Emergency Patch Release 3 covers v24/v25/v26 only — PaperCut's stated path for 23 and earlier is upgrade, not a patch.

Project Online retired September 30, 2026 under the Modern Lifecycle Policy — the service stops, not just support, and Microsoft's guidance is to back up data first. It isn't listed on Microsoft's 'Ending Support in 2026' roll-up page. The verified timeline and the three migration paths: Planner premium, Project Server Subscription Edition, Dynamics 365 Project Operations.

Four unrelated vendors, one date: Project Online retires outright, FortiOS 7.2 and four SonicOS releases hit end of support, ten Azure services shut down - with ASA 9.23's end-of-sale the day before and NetScaler 13.1's end of maintenance two weeks earlier. The verified cluster and the 29-day triage order.

On one Patch Tuesday — October 13, 2026 — the final ESU year for Windows Server 2012 and 2012 R2 ended, Windows 10's first commercial ESU year expired (consumer ESU now runs to October 12, 2027), and Windows Server 2022 left mainstream support. What each clock meant, the triage order for the weeks after it, and the Exchange Server 2016/2019 ESU deadline 19 days behind it.

Oracle Discoverer's last patches shipped June 2017. Endeca's between 2018 and 2021. Forms and Reports 11g in 2018. None of them ever got an end-of-life announcement — they slid into indefinite Sustaining Support instead. Every date from Oracle's own Lifetime Support brochure (effective April 13, 2026), what Sustaining Support actually covers, the Forms upgrade path that still exists (Fusion Middleware 14.1, supported to 2033), and the options for estates still running any of it.

Ubuntu 22.04 LTS standard support ends May 31, 2027; 24.04 runs to May 31, 2029 (ESM to 2034); 20.04 left standard support in May 2025 and is ESM-only to April 2030; 16.04's ESM closed in April 2026 making it fully end of life. Every release's dates across all three support tiers — standard, Ubuntu Pro/ESM, and the Legacy add-on — verified against Canonical's release cycle.

Apache Tomcat's own security pages state that for end-of-life versions the status of new vulnerabilities defaults to unknown, the pages are never updated, and no announcement is made. Scanners read that silence as a clean bill of health. Shown concretely on the actively exploited CVE-2025-24813, where the entire Tomcat 10.0 line and everything before 8.5 carries status unknown.

CISA added CVE-2026-60004 - a CVSS 9.8 code-injection flaw in Gitea's diffpatch endpoint - to the KEV catalog on August 25 with an August 28 deadline. Gitea's own advisory puts the affected range at 1.17 through 1.27.0: four years of releases. With no LTS and no backports, the only supported destination is 1.27.1 or later.

CISA added CVE-2026-21962 - a CVSS 10.0, unauthenticated flaw in Oracle HTTP Server and the WebLogic Server Proxy Plug-in - to the KEV catalog on August 24 with an August 27 deadline. Only WebLogic 12.2.1.4, 14.1.1 and 14.1.2 ever received the January 2026 patch; Oracle says earlier versions are likely affected but untested. And 12.2's own Premier Support cliff lands December 2026.

Palo Alto Networks retired the QRadar SaaS products acquired from IBM: QRadar EDR, X-Force Threat Intelligence, Randori Attack and QRadar Advisor with Watson all reached end of life August 31, 2026 - and Randori Recon, Resilient/SOAR on Cloud and the XDR-package SKUs already shut down April 14. A SaaS end of life is a hard stop: nothing to keep running, nothing to extend.

Microsoft’s own 2026 end-of-support page lists more than twenty Azure services, APIs and SDKs shutting down across seven September dates — 13, 14, 15, 17, 19, 21 and 30 September 2026. Azure Virtual Desktop (Classic), Azure Functions 1.x, five Computer Vision API versions, three generations of Service Bus control-plane APIs and more, with Microsoft’s documented migration path for each.

CISA added Zimbra’s CVE-2026-73570 (unauthenticated OS command injection via the optional SNMP component, CVSS 8.9) to the Known Exploited Vulnerabilities catalog on August 21, 2026 with an August 24 federal deadline. The only fix is Zimbra 10.1.20 (July 20, 2026). Zimbra 8.8.15, 9.0 and 10.0 are past vendor support and received nothing — and the vendor’s own patch-release history shows the backports stopping one line at a time, unannounced: 9.0’s last patch June 2025, 10.0’s last patch November 2025, 10.1.x alone ever since. Verified dates, who has a fix, and what to do by the deadline.

Original research: 624 candidate (product × CVE) pairs from crossing CISA’s exploited-vulnerabilities catalog with verified end-of-life data — the ~98 most plausible verified line-by-line against vendor advisories. Roughly 88% failed, mostly because vendors quietly patch dead versions: Apache backported ActiveMQ’s worst flaw to every EOL line, Adobe hotfixed EOL Commerce, Fortinet patched EOL FortiOS — even the Equifax-era Struts flaws were fixed in 2.3. Where unpatchable truly lives: hard-cutoff vendors, appliances that say “No Patch Planned,” and single-line open source.

'Altiris' lifecycle data lives under Symantec IT Management Suite on Broadcom's portal. Verified there: every version before 8.5 is end of life; ITMS 8.6 and its component suites reached end of support June 1, 2026; the 8.7 line has no announced date; ITMS 8.8 / 8.8.1 is the migration target Broadcom names. The naming history that breaks every search, the dates, and the three ways forward.

Red Hat AAP 2.5 left Maintenance Support 1 on October 2, 2026 — the last phase with Important-severity security fixes and any bug fixes. Maintenance Support 2 (Critical-only) runs to October 2, 2027. AAP 2.4's final window already closed June 30, 2026; AAP 2.6 (October 1, 2025) is the version to be on. The phase table, verified dates for 2.4–2.6, the 2.5 → 2.6 upgrade path, and the annual cadence to plan around.

Nine Java runtime lines reached end of life in September 2026: SapMachine 17 (September; SAP prints the month only), the non-LTS 26 series across six vendors as JDK 27 ships, and — the big one — Oracle JDK 17 Premier Support and Oracle GraalVM 17 on September 30. Dates read at each vendor's lifecycle pages. The full table, the free escape routes that keep JDK 17 patched into 2027–2029 (Temurin, Corretto, Zulu, Microsoft), and Oracle Extended Support (subscription required; Oracle waives the Extended Support fee October 2026 to September 2029).

CISA added MLflow’s CVSS 9.3 SSRF flaw CVE-2026-64849 to the Known Exploited Vulnerabilities catalog on August 19, 2026 with a September 2 federal deadline. GitHub’s advisory records the fix as first patched in 3.15.0 — no 2.x backport exists, and the 2.x line has been silent since 2.22.5 on May 12, 2026 with no end-of-life announcement. The third AI infrastructure tool on KEV in six weeks, after Ray and Langflow. The verified dates, who is exposed, and the upgrade path.

IBM's own dates for every Netezza appliance generation, the 2028 end of support for Cloud Pak for Data System, and what IBM still sells. No service extensions.

IBM's lifecycle page puts z/OS 2.5 end of support at September 30, 2026 (GA September 30, 2021; withdrawn from marketing January 29, 2024). z/OS follows the Enhanced policy — five years standard, up to three more paid — so the bridge exists at mainframe prices. The verified dates for 2.3 through 3.2, what the extension covers, the 3.1/3.2 upgrade path and coexistence rule, how to check your release, and the decision framework.

Drupal 7 reached end of life on January 5, 2025 — no more security or compatibility fixes for core or contributed modules. What actually ended, the supported Drupal 10/11 releases and their dates (10.6 and 11.3 to December 2026; 11.4 to June 2027), how to check your version, why 7 → 10/11 is a migration not an update, and the two realistic exits: migrate, or certified extended support while you migrate.

On August 18, 2026 CISA added two actively exploited flaws to its KEV catalog that are end-of-life stories. CVE-2026-65400 (macOS Screen Sharing authentication bypass) was fixed August 6 only in Tahoe 26.6.1, Sequoia 15.7.9 and Sonoma 14.8.9 — Ventura and older get nothing, and Apple sells no extended support. CVE-2026-33824 (Windows IKE double free, CVSS 9.8) was patched April 2026 including Windows 10 22H2 — but that update is ESU-only, six months after the October 14, 2025 end of support. Who has a fix, who does not, and what to do by the August 21 federal deadline.

Master Data Services (MDS) is removed in SQL Server 2025 and supported only in SQL Server 2022 and earlier — so its end of life is SQL Server 2022's: mainstream support to January 11, 2028, extended support to January 11, 2033. MDS dates by host version (2016 already past extended support), what removed means for upgrades, how to check, and the replacement options.

Symfony 2.8 LTS ended November 1, 2019, 3.4 on November 1, 2021, 4.4 on November 21, 2023. Today's LTS lines: 5.4 (security fixes only, to February 2029), 6.4 (bug fixes to November 2026, security to November 2027) and 7.4 (to November 2029); Symfony 8.0 ended in July 2026. Every release's dates, the six-month/two-year rule, how to check your version, and the LTS-to-LTS upgrade path.

CISA added CVE-2026-59310 (CVSS 9.8, path traversal in the vCenter Syslog server, remote code execution) to its KEV catalog on August 18, 2026, deadline August 21. Broadcom's VMSA-2026-0006 fixes it in vCenter 8.0 U3k / U2f and VCF 9.0.2.0100 / 9.1.0.0300 — and for vCenter 7.0 (general support ended October 2, 2025) says only: contact Broadcom Support if you have an extended support contract. What that means for perpetual licences with lapsed SnS, why the 8.x-only zero-day program does not help, and what to do this week.

VMware perpetual licenses are end of availability, not end of life: Broadcom stopped selling them and SnS renewals (announced December 2023, listed January 2024), existing licenses keep running and are supported to the end of their contract — then patch, upgrade and support access stop, except zero-day (CVSS ≥ 9.0) fixes on vSphere 8.x. vSphere 7.0 passed general support on October 2, 2025; 8.0 runs to October 11, 2027. What ended, what you keep, how to check, and the four options.

Atlassian's two-year rule retired Bamboo 10.0 on August 21, 2026 and Jira Software 10.0 on August 22 — one day apart, and most Atlassian shops run both. Neither is an LTS. The next LTS on each (Bamboo 10.2, Jira 10.3) ends in December 2026 as well, so the real landing zones are Bamboo 12.1 and Jira 11.3. Every date, and the third piece of the Data Center set with Confluence and Bitbucket.

Atlassian retires every Confluence version exactly two years after its release. Confluence 7.13 LTS died August 17, 2023, 7.19 LTS on December 13, 2024, 8.5 LTS on December 15, 2025 — and 9.2 LTS goes on December 10, 2026. Confluence carries nine CISA KEV entries and a ransomware flag, so an unpatched 7.x or 8.x server is a documented target. Every version's date, which LTS to land on, and what the searches for old versions really mean.

Elasticsearch minors live about six months — 9.1, 9.2 and 9.3 are already end of life — but the LAST minor of each major gets the long tail: 8.19 is supported to July 15, 2027, outliving three 9.x releases. Elasticsearch 7 ended January 15, 2026 and is in the CISA KEV catalog. Every version's date, Elastic's actual policy, and which line to be on.

NumPy 2.1 reached end of life on August 19, 2026 under NEP 29's 24-month rule. The same schedule dropped Python 3.11 from NumPy's support floor that day (3.12+ / 2.2+ from August 19), even though Python 3.11 itself lives to October 2027. And if you are still on Python 3.10, your last supported NumPy died in June 2025. Two clocks, every date, and what to do.

Apache Camel 4.14 reached end of life on August 11, 2026 — nine days before the August 20 date most trackers still publish — because Camel ends an LTS when the next LTS ships, and 4.22 shipped early. Meanwhile Camel's own support page and LTS policy post have vanished from camel.apache.org. What is actually supported now (4.22 and 4.18), the 5-to-68-day non-LTS treadmill, and how we verified the date.

Bitbucket Data Center 9.1 reached end of support on August 27, 2026, exactly two years after release — and Atlassian's two-year clock retires 9.2 in September, 9.3 in October, and the 9.4 LTS in December. Why the KEV history makes unpatched Bitbucket a proven target, and why 10.2 LTS is the upgrade that skips the treadmill.

CentOS 7 has been end-of-life since June 30, 2024 and CentOS 8 since December 31, 2021 — yet both still run production fleets. A commercial extended-support market patches them anyway: what CentOS ELS actually covers, who sells it, what it defensibly buys, and when migration to RHEL, AlmaLinux or Rocky is the better spend.

containerd 1.7, the final 1.x release line, reached end of life on September 30, 2026 after three and a half years as an LTS. It is the container runtime under most Kubernetes nodes and Docker hosts — and the component almost no inventory lists. What changes, the 1.x to 2.x migration reality, and why 2.3 LTS (April 2028) is the landing zone.

There is no Kubernetes LTS release: every minor version gets roughly 14 months (12 standard + 2 maintenance) and a new one ships every four months. Long-term support does exist — as a paid tier on EKS (26 months), AKS (~24 months) and GKE (~24 months). What each really covers, what it costs you, and why Kubernetes 1.32 has been unpatched since February 28, 2026 for anyone who thought otherwise.

Proxmox VE 8, Proxmox Backup Server 3, and Proxmox Mail Gateway 8 all reached end of life on August 31, 2026 — the same day, because all three ride Debian 12's security lifecycle. It is the third time the whole family has retired in lockstep. Every date, the pattern, and the upgrade paths to the 9/4-era.

Traefik 3.6 reached end of security support on August 16, 2026. It is the first Traefik minor ever given a security tail — before the v3.6 policy change, the average 3.x minor lived 93 days and died the day its successor shipped. Traefik 3.7 is now the only supported line, and Traefik 2.11 — the last v2 release — lost security support on September 7, 2026.

Grafana 12.3 reached end of life on August 19, 2026 — exactly nine months after release. Grafana's 15-month window only applies to the last minor of a major line, which is why 12.4 (EOL May 24, 2027) outlives both Grafana 13.0 and 13.1. Every date, verified against Grafana's own support policy.

Mattermost 10.11 reached end of life on August 15, 2026. It is one of only two releases in 57 that got a twelve-month support window instead of the usual three — and the newest release, 11.11, expires on December 15, 2026. The upgrade that buys you the most time is an older version. Every date, and why.

React には公式のサポート期限（EOL 日）が存在しません。React 19・18・17・16・15 の公開日・最終リリース日・EOL リスクスコアを一覧で整理し、「期限がない」ことが安心材料ではない理由、React 18 の「凍結」状態の見分け方、CVE-2025-55182 の正確な影響範囲、稟議や保守契約で使える判断材料までを日本語で解説します。

CVSS says how bad, CISA KEV says whether it is being exploited, EPSS says how likely it is next. On our Exploited & Unpatchable feed they openly disagree — a confirmed-exploited FortiOS flaw sits at 1.26% EPSS while a TeamCity flaw at CVSS 9.8 sits at 10.7%. How to read all three, and what changes when the software is end-of-life.

CVE-2026-34197, the exploited ActiveMQ RCE via the Jolokia JMX-HTTP bridge (effectively unauthenticated on 6.0/6.1), is fixed only in 5.19.4 and 6.2.3 — five EOL lines (5.16–5.18, 6.0, 6.1) will never receive the patch.

Confluence Server reached end of life February 15, 2024. Three CISA KEV-listed CVEs — including CVSS 10.0 CVE-2023-22518, mass-ransomed since November 2023 — have fixes only on supported branches. Which branches carry which bugs forever, and what to do about it.

The software end-of-life management process in six steps, each built on our published research: inventory the six places EOL software hides (appliances, FROM lines, CI runners, cloud services, the RMM console itself) and the version-string traps (RHEL 8.6, AIX Technology Levels, MQ's dspmqver, GitLab's 91-day window); map to lifecycle truth that re-verifies (54 products checked, 12 corrected, 6 fixes merged upstream); prioritize with the 40/30/20/10 risk model and the exploited-and-unpatchable tier; decide migrate vs extended support vs documented acceptance on the horizon question; gate new debt at procurement (OpenEoX), CI, and base images; and keep the audit evidence map — EU CRA, NIS2, DORA, CISA BOD 26-02/26-04, PCI DSS 4.0.1 12.3.4. Free policy template included, no signup.

Five KEV-listed CVEs map onto EOL ESXi versions: CVE-2024-37085 is ransomware-exploited and Broadcom lists ESXi 7.0 as No Patch Planned; 6.5 and 6.7 stopped receiving fixes in 2022 and carried the ESXiArgs wave. Which versions get patches, which never will, and the upgrade-or-isolate decision.

The first cross-vendor pricing reference for post-EOL extended support. Microsoft ESU: $61/device doubling yearly ($30 one-time for consumers). AWS: EKS $0.60/cluster-hour (6x), RDS $0.100/vCPU-hour doubling in year three. Ubuntu Pro: $25 desktop / $500 server per year. Oracle's Java 17 fee waiver, and the honest quote-based rows — Red Hat ELS, Oracle Database, SUSE LTSS, CentOS ELS — where no public price exists. Every figure traced to a vendor price page or our verified coverage.

IBM i 7.4 reached end of standard support September 30, 2026 — the same day as Oracle JDK 17 Premier and FortiOS 7.2, and the day 7.3's first Service Extension window closed. Every release's dates from 1988's AS/400 to 7.6, the paid Service Extension ladder (7.3 to 2028, 7.4 announced to 2029), and the hardware coupling: Power7 tops out at 7.3, Power8 at 7.4, 7.6 needs Power10.

IBM MQ 9.3 end of support is September 30, 2027 (extended support to 2031) — and MQ 9.2's standard support already ended September 30, 2025. Full release dates and end-of-support table for every MQ version from MQSeries 5.2 to MQ 10.0, IBM's LTS vs CD support model (LTS gets 5+ years, CD releases lose fix eligibility in months), and why 9.4's unannounced date follows IBM's 12-month-notice policy.

NetApp supports each ONTAP release for 3 years of full support — then 2 years of limited support that ships no patches of any kind. ONTAP 9.13.1 crossed the patch cliff June 30, 2026; 9.14.1 ends January 31, 2027; 9.15.1 ends July 31, 2027 and 9.16.1 February 26, 2028. Every version's full and limited support dates, the FAS/AFF hardware coupling, and the upgrade rhythm.

Oracle Database 19c Premier Support ends December 31, 2029, with Extended Support to December 31, 2032 — dates Oracle extended in November 2024 from the original April 2024/2027 schedule. The 21c trap: the newer release is an Innovation Release that dies July 31, 2027, before 19c itself, with no Extended Support. Every Oracle Database version's Premier and Extended dates, the Sustaining Support fine print, and the 19c-to-23ai/26ai path.

Oracle Solaris 11.4 is supported to November 2031 (Premier) and November 2037 (Extended) per Oracle's Lifetime Support Policy — the platform outlived Sun Microsystems by more than a quarter century, maintained as a terminal release via continuous-delivery SRUs (there is no Solaris 12). The real deadline: Solaris 11.3 AND Solaris 10 both lose Extended Support in January 2027, then drop to Sustaining Support — indefinite, but no new security fixes ever. Every version's dates, the two live CISA KEV Solaris entries, and the 11.3-to-11.4 in-place update path with its SPARC T4+ hardware gate.

Palo Alto publishes software EOL per PAN-OS release and hardware EOL per appliance, on two different pages. PAN-OS 11.2 dies May 2, 2027 — one day before the older 11.1 — and 10.2 already passed August 27, 2025. The PA-5250 (PA-5200 Series) hits hardware EOL August 31, 2028, capped at PAN-OS 11.2 forever. All 26 versions' dates, six version-order inversions, and the 13 PAN-OS entries in CISA's KEV catalog — six with known ransomware use.

CVE-2025-49113, the KEV-listed deserialization RCE in Roundcube Webmail, is fixed only in 1.5.10 and 1.6.11 — the EOL 1.4, 1.3, and 1.2 lines will never receive a patch, leaving upgrade or decommission as the only fixes.

CVE-2026-63077, an unauthenticated RCE in JetBrains TeamCity added to CISA KEV on August 5, 2026, is fixed only in 2025.11.7 and 2026.1.3. Nine EOL version lines will never receive the fix. The 30-second version check and the upgrade-or-isolate decision.

TLS 1.2 is not end of life — no standards body has deprecated it, and NIST SP 800-52r2 and PCI DSS both permit it today. The dead versions are TLS 1.0 and 1.1: deprecated March 2021 by RFC 8996 (MUST NOT be used), removed from every major browser in 2020, banned from payment environments since June 30, 2018 — and still found in production. TLS 1.3 (RFC 8446, August 10, 2018) is the current standard with no deprecation planned. Every version's dates, plus the PCI DSS / NIST / CRA / NIS2 compliance matrix.

Every VMware Cloud Foundation 4.x release is already end of life — 4.5.2, the last of the line, ended October 2, 2025. VCF 5.0 and 5.1 both die June 1, 2027; 5.2 follows October 11, 2027. The version-number trap: VCF 9.0 ends November 12, 2027, only 32 days after 5.2 — the longest published runway is 9.1, to August 12, 2028. All 16 versions' dates, the documented record of what Broadcom did with Tanzu (legacy SKUs retired May 2024, TKG continuing as vSphere Kubernetes Service inside VCF 9), the CISA KEV exposure of the ESXi 7.0 that VCF 4.x bundles, and the honest exit paths.

Amazon EKS supports each Kubernetes version for 14 months of standard support, then automatically enrolls clusters in extended support — no opt-in — at $0.60 per cluster per hour instead of $0.10 (~$438/month instead of ~$73 per cluster). After 12 months of extended support, AWS auto-upgrades the control plane to the oldest supported version. EKS 1.33 crossed into extended support July 29, 2026; 1.31's extended support ends November 26, 2026. Every version's dates, verified against AWS's release calendar and pricing page.

The latest Android version is Android 17 (Cinnamon Bun), released June 16, 2026. Android 14, 15, 16 and 17 still receive Google security patches; Android 13 and older do not. The complete table of all 34 Android versions — codename, API level, release date, support status — and why your phone's support differs from your version's.

Atlassian supports each Jira and Confluence Data Center release for exactly two years from its own release date — Jira 10.0 died August 22, 2026 and Confluence 9.0 on July 30, 2026. Server products lost all support February 15, 2024, and three Confluence CVEs sit in CISA's KEV catalog with known ransomware use, permanently unpatchable on the EOL versions attackers find them on. Both full version tables, the LTS cadence, and the Data Center vs Cloud fork.

AIX support expires per Technology Level, not per release: each TL gets fixes for 3 years per IBM's published policy. AIX 7.3 TL2 reaches End of Fix Support November 30, 2026, while TL3 runs to December 2027 and TL4 to December 2028. The AIX 7.2 TL5 anomaly (EoFS still to be determined), the 7.1 Service Extension precedent, and every Technology Level's dates verified against IBM's lifecycle page.

Mule 4.4 — the runtime the 2021–2023 integration build-out standardized on — lost Extended Support October 8, 2025, yet stays among the most-asked-about versions in our data. Under MuleSoft's Edge/LTS policy, Edge releases live 8–12 months release-to-EOL (4.11 dies in October 2026) while LTS carries ~3 years. Why production belongs on 4.9 LTS (EOL February 2028), the CloudHub forced-upgrade rule, and every version's dates.

Nutanix AOS 6.10 reached End of Support Life October 31, 2026 — but its End of Maintenance already passed January 31, 2026, so the release has run on troubleshooting support with security fixes only for over six months. 6.10 is the last AOS release flagged LTS; since AOS 7.0 every release runs a unified ~24-month clock (15 months maintenance + 9 months troubleshooting). Every AOS version's dates and the honest 7.3 vs 7.5 vs 7.6 landing comparison.

Proxmox VE 8 reached end of life August 31, 2026 — no extended support, no LTS: Proxmox supports each release at least as long as its Debian base has Debian Security Team coverage, and Debian 12 crossed that line July 12, 2026. The in-place 8→9 upgrade (Debian 12 Bookworm to 13 Trixie, pve8to9 checklist), every version's dates, and why the post-Broadcom VMware migration wave makes this the first Proxmox EOL many admins have planned for.

RHEL 8 のサポート期限（メンテナンスサポート終了）は2029年5月31日、RHEL 9 は2032年5月31日。RHEL 7/8/9/10 の GA・フルサポート終了・EOL・ELS の日付を一覧表で整理し、最新マイナーリリースしかパッチを受け取れない「マイナーバージョンの罠」まで解説する日本語版 RHEL ライフサイクル完全ガイド。

RHEL 8 is supported until May 31, 2029 — and a RHEL 8.6 box has received zero patches since November 9, 2022 unless it carried EUS. Only the latest minor of each major (8.10, 9.8, 10.2) rides the standard patch stream; even-numbered minors get ~2-year EUS windows, odd minors get nothing. Every 8.x and 9.x minor release — release date, supersession date, EUS end date — hand-verified against Red Hat's lifecycle API.

Zabbix 7.4 has no dated end of life: Zabbix says full support until 8.0 LTS ships, limited support to Q1 2027. 6.0 LTS: critical fixes to Feb 28, 2027.

The biggest end-of-life surprises of 2026 so far, every claim from a primary source: one in six vulnerabilities CISA confirmed as actively exploited this year is three-plus years old, FortiOS 7.0 became permanently unpatchable ten months after EOL, SharePoint's last patch ever fixed a flaw already under attack, Microsoft quietly moved the Windows 10 consumer ESU wall a year via a blog editor's note, AWS edited its Lambda dates in place, and the EU CRA's exploited-vulnerability reporting regime starts September 11.

FortiOS 7.2 reached End of Support September 30, 2026 — the end of even critical fixes, on a train that has been critical-fixes-only since engineering support ended March 31, 2025. FortiOS 7.0 crossed the same line last September; within ten months, CVE-2025-68686 was added to CISA's KEV catalog, affecting every 7.0 release, with the fix shipped only to supported trains. Every FortiOS version's dates and the 7.4 / 7.6 / 8.0 decision.

GitLab 19.0 left the security-patch window August 20, 2026 — 91 days after it shipped. GitLab patches only the current monthly release and the two before it, so "we upgraded recently" and "we're supported" are different claims: 18.11 already expired July 16, and 19.1 followed September 17. The rolling three-release window, the live CISA KEV record (four GitLab CVEs, two added in 2026), and why required upgrade stops make waiting compound.

September 2026 ended Oracle Premier Support for JDK 17 — not free updates (Oracle's NFTC window closed September 2024) and not Java 17 itself. Oracle's roadmap waives the Extended Support fee through September 2029, and the cross-vendor table runs later everywhere: Temurin to Oct 2027, Microsoft and Red Hat builds to 2027, Corretto to Oct 2029, Zulu to Sep 2029.

Red Hat OpenShift 4.18 exited maintenance support August 25, 2026. Patches don't stop for everyone: EUS continues to February 25, 2027 — included with Premium subscriptions, a paid add-on on Standard — with Term 2 to February 25, 2028. The even/odd EUS rhythm, why 4.19 is a four-month landing with no safety net (maintenance ends December 17, 2026), and the honest 4.20/4.21/4.22 comparison.

Both Microsoft and OpenAI retire the Assistants API on August 26, 2026 — Azure moves to Foundry Agents, OpenAI to the Responses + Conversations APIs. The migration tooling moves your code but not your data: past threads, runs, and messages don’t come across.

CVE-2026-70426, a critical deserialization bypass allowing remote code execution on the Jenkins controller, is fixed only in 2.576 and LTS 2.568.2. Under Jenkins’s rolling-LTS policy, every older LTS line — 2.555 and back — will never receive this fix.

A CVSS 8.2 authorization bypass in Quarkus is fixed in current releases — but 55 of the 58 Quarkus release lines we track are past end of life, and the entire 2.x family will never see the patch. Which versions are fixed, which are stranded, and the real options for each.

CISA says attackers are exploiting N-able N-central right now — and legacy consoles can't take the fix until they migrate to a supported version first. The 20-minute audit that tells you what your MSP's patching actually covers, including the console doing the patching.

Cisco, Microsoft, Oracle, Red Hat, IBM — with CISA and the NSA at the table — are writing OpenEoX, the OASIS standard for machine-readable end-of-life data. Its public review ran until August 13, 2026. What the draft gets right, what it misses, and the comments endoflife.ai filed.

Debian 11 (Bullseye) LTS ended August 31, 2026 — since then, no free security updates at all; only paid Extended LTS (Freexian, listed through June 30, 2031) continues. Why five-year-old Bullseye installs are the forgotten ones — appliances, CI runners, docker FROM lines — the release-to-wall timeline, the Debian 12 wrinkle (already past standard support), and the find-your-bullseye checklist.

AWS pushed the operational blocks for its entire old-runtime cohort — Node.js 16/18/20, Python 3.8/3.9, Ruby 3.2, .NET 6 and provided.al2 — to July 29, 2027 (block create) and August 31, 2027 (block update), so most published schedules are now wrong in both directions. What didn't move: nodejs20.x stopped receiving security patches April 30, 2026. The verified three-stage table and the upgrade path to nodejs22.x/24.x.

Citrix Virtual Apps and Desktops 2203 LTSR reaches end of life March 23, 2027 — the end of its five-year mainstream window. What stops, the eligible-customers extended-support window (no published end), and the honest 2402-vs-2507 LTSR migration comparison (2402 is supported longer: April 15, 2029 vs August 18, 2028).

Horizon 7 is fully out of support since April 2025; Horizon 8 — now Omnissa Horizon — is alive, but every release runs a three-year clock. 2303, 2306 and the 2212 ESB all expired in 2026; 2309 ended October 26, 2026. Every version's dates per the Omnissa Lifecycle Matrix, the ESB vs Current Release model, the Broadcom-to-Omnissa handoff, and migration options.

Nuxt 3 reached end of life on July 31, 2026 after a six-month extension. Nuxt 3.21.10 was the final release. The EOL Risk Score, what stops shipping (including Nitro and h3), why Nuxt 4 has no fixed EOL date, and extended-support options.

Amazon RDS for MySQL 8.0 reached end of standard support July 31, 2026, and RDS Extended Support charges began the next day. Enrollment is automatic unless it was explicitly disabled at instance creation. The per-vCPU-hour rates, the Multi-AZ multiplier, the year-three doubling on August 1, 2028, and the only two ways to stop the charge.

JADEPUFFER is the first ransomware intrusion documented as run end-to-end by an autonomous LLM agent. It needed no novel exploit: it entered through a Langflow flaw patched in March 2025, walked past a storage service still using its installation-default password, and authenticated to Nacos with a signing key published in 2020. What that means for anyone still planning to upgrade next quarter.

Arista's advisory for the actively exploited VeloCloud Orchestrator flaw (CVE-2026-16812, CVSS 10.0) contains one line most readers skip: "End of support software versions have not been assessed." What that means if you run an older VCO, the July 30 federal deadline, and why unsupported software gets silence instead of answers. Updated for the third exploited VCO flaw, CVE-2026-114625.

convert2rhel supports CentOS Linux 7.9 and 8.5 (and AlmaLinux/Rocky/Oracle Linux) — but NOT CentOS Stream. Which version lands where, the underrated CentOS 7 → RHEL 7 ELS play, and the cases where conversion is the wrong move.

Every IBM enterprise end-of-support date in one place: z/OS 2.5 and IBM i 7.4 both died September 30, 2026, Db2 11.5 follows April 30, 2027, and AIX 7.3 TLs roll off from November 2026. The full matrix, IBM's fiscal-quarter EOS rhythm, the Power8 trap, and what a Service Extension really costs.

RHEL 10 (released May 20, 2025): full support ends May 31, 2030, maintenance ends May 31, 2035, ELS beyond. Every RHEL version's three lifecycle phases in one table, and the nearer deadline most teams miss — RHEL 9 full support ends May 31, 2027.

CISA now mandates risk-based patching (BOD 26-04: 3-day deadlines for exposed+exploited+automatable+total-control) and eviction of end-of-support edge devices (BOD 26-02). What the directives require, and why EOL status is the fifth risk variable.

There is no single Java EOL date. Oracle JDK 17 Premier Support ended in September 2026 (Extended Support fee waived to September 2029), Oracle JDK 21's free-use updates ended the same month, Red Hat's OpenJDK 8 ends November 30, 2026 — while Temurin, Corretto, Zulu, Microsoft and IBM carry the same versions free to 2027–2032. Every LTS (8, 11, 17, 21, 25) across eight distributions, the Oracle licensing layer, how to identify your vendor, and what to do.

OpenSSL 3.0 died September 7, 2026 — four days before EU CRA reporting began. Who is actually exposed (bundled copies, not distro packages), the autumn EOL pile-up, and why 3.0→3.5 LTS is easier than feared.

Oracle's July 2026 Critical Patch Update is its largest ever — 1,449 security patches, roughly 1,235 unique CVEs. Oracle's own advisory says releases outside Premier or Extended Support are not tested for those vulnerabilities, and are likely affected anyway. Why an empty advisory row is not a clean bill of health.

CVE-2026-50522, a CVSS 9.8 SharePoint remote code execution flaw, went from public proof-of-concept to active exploitation and onto CISA's Known Exploited Vulnerabilities list on July 22, 2026. It was fixed in the July 14 updates, released the day SharePoint 2016 and 2019 left support. Federal deadline: July 25.

Android 13 reached end of life March 2, 2026 — Android 14, 15, 16 and 17 remain supported. The complete Android version EOL table, how Google's security bulletins work, and why your device's clock differs from the OS clock.

Debian 11 Bullseye's LTS ended August 31, 2026. The three support tiers explained (standard, LTS, paid ELTS), why upgrading to 12 buys less than it sounds, and the container FROM-line catch.

Db2 11.5 — the version most estates run — dies April 30, 2027, and Db2 12.1 is the only successor. Every version's dates, IBM's predictable April-30 rhythm, and why 2026 is the assessment year.

Apple publishes no iOS lifecycle calendar — patches just stop. iOS 26 and 18 are fully supported; iOS 15/16 get unpredictable emergency fixes; iOS 12's final patch came January 2026. Every version's dates.

iPads get updates for 5–8 years, but Apple never announces the end date — support follows the chip, and models die in cohorts. Every iPad model's status and when to retire it from sensitive use.

Apple supports the current macOS plus two — macOS 13 Ventura died September 15, 2025. Every macOS version's EOL date, the unwritten September rule, and the Intel Mac hardware catch.

Magento 2.4.9 (May 12, 2026) is the current version. 2.4.6 lost standard support August 11, 2026, and 2.4.5's extended window closed August 12. Every release with dates verified against Adobe's lifecycle table, the three support tiers, Open Source vs Commerce, and Adobe's published release schedule.

Office 2016 and 2019 both hit end of support October 14, 2025. Office 2021 followed on October 13, 2026, the same day Windows 10's first commercial ESU year ended. Every Office release's dates, and why there is no ESU for Office.

Oracle Linux 7 left premier support December 31, 2024 — extended support runs to June 2028. OL8 to July 2029, OL9 to June 2032. Every version's dates and why Oracle's clock differs from RHEL's.

PostgreSQL 14 dies November 12, 2026 — no more security or data-corruption fixes, per the exact five-year November rhythm. Every version's dates, why to target 16/17 not 15, and what to do if November is impossible.

The complete Samsung Galaxy end-of-life list: all 437 tracked devices with release and security-update end dates — S series, foldables, Note, A/M/F/J and more. 323 are already past end of support; recent flagships get 7 years.

Splunk Enterprise versions get almost exactly two years of support. 9.3 died July 24, 2026; 9.4 follows December 16, 2026 — then all of 9.x is gone. Every version's dates and how to live with the two-year clock.

Microsoft publishes an exact end-of-servicing date for every Surface — about six years per model. Every device's date, the firmware-vs-Windows distinction, and the Windows 10 double cutoff.

Windows Server 2016 extended support ends January 12, 2027; 2012 R2 ESU and 2022 mainstream support ended October 13, 2026. Every version.

debian:10, ubuntu:20.04, node:18-alpine — these tags still pull and build, but the OS inside stopped getting security patches. How to audit every FROM line in your fleet, what "the tag still works" actually means, and the base images to move to.

AWS's June 30 announcement is its largest coordinated service retirement ever: ~20 services including Kendra, Q Business and Bedrock Agents Classic close to new customers July 30, 2026; WorkSpaces PCoIP and four others shut down June 2027; two are already gone. The full plain-English list with AWS's recommended migration targets.

Original research: we cross-checked 54 products against official vendor lifecycle documentation. 33 verified exactly, 12 dates corrected, 7 products have no vendor-published dates at all — and all six upstream correction PRs were merged by endoflife.date's maintainers on July 21, 2026. A field guide to how EOL dates drift.

SharePoint Server 2016 and 2019 reached end of support on July 14, 2026, the same day Microsoft patched CVE-2026-58644, a CVSS 9.8 remote code execution flaw already exploited in the wild. We called that the last update they would ever get; on August 11, 2026 Microsoft shipped another, and one flaw it fixes, CVE-2026-65660, is now in the CISA KEV catalog.

The White House's Gold Eagle clearinghouse launched July 14 to coordinate AI-discovered vulnerabilities at machine speed — 35,364 CVEs landed in H1 2026 alone. But a remediation pipeline needs somewhere to send the fix, and for end-of-life software there is no somewhere.

Open source EOL dates are becoming machine-read infrastructure: AI agents query them, regulators mandate them, insurers underwrite on them. What AI actually changes about software lifecycles — and what it can't — for anyone responsible for compliance.

DORA has applied since January 17, 2025 — and it names legacy ICT systems explicitly. Why end-of-life components are the purest form of the risk it regulates, and the lifecycle process a financial entity's ICT risk framework can actually ingest.

The CRA's vulnerability reporting obligations begin September 11, 2026 — over a year before the main obligations everyone plans around. Why end-of-life components inside shipped products just became a regulatory liability, and the compliance-ready lifecycle process.

NIS2 requires vulnerability handling — but an end-of-life component has no patches to apply. What the directive asks of essential and important entities, why EOL software breaks it, and the management-accountability angle that makes this a board question.

Cyber-insurance questionnaires increasingly ask about end-of-life software — and most organizations genuinely don't know their answer. Why the question is hard, what unsupported really spans, and the four-step playbook to answer it honestly.

OpenSSL 3.0, Oracle JDK 17, Windows Server 2012 ESU, Python 3.10, .NET 8 and 9, PostgreSQL 14, and PHP 8.2 all reach end of life between September and December 2026. The full calendar, what stops on each date, and the survival plan.

Oracle JDK 8 support ended March 2022, JDK 11 in September 2023, and JDK 17 lost support in September 2026. How Oracle's per-employee licensing turned old Java into audit exposure, and the OpenJDK escape path.

AngularJS reached end of life December 31, 2021. The migration options that actually work in 2026 — incremental rewrites to Angular, moving to another framework, and extended support as a bridge.

CentOS 7 reached end of life June 30, 2024. Two years on, the realistic paths: in-place conversion to Rocky Linux or AlmaLinux, a move to RHEL, or extended support while you plan the migration.

Node.js 18 reached end of life on April 30, 2025 — and Node 20 followed on April 30, 2026.

PHP 7.4 reached end of life November 28, 2022, yet PHP 7 still runs across production. The practical upgrade path to PHP 8.x — breaking changes, tooling, and how to sequence the jump.

Windows 10 reached end of life October 14, 2025, and consumer Extended Security Updates run only to October 2026. The migration paths to Windows 11 — hardware checks, in-place upgrade, and what to do with ineligible machines.

Original research from the endoflife.ai dataset: across 463 products and 7,144 versions, the median supported lifespan is just 1.5 years. How long each software category actually lives, the extremes, and what it means for your upgrade cadence.

.NET 8 end of life (EOL) and end of support is November 10, 2026, the same day as .NET 9. Is .NET 8 LTS, what stops that day, and the move to .NET 10.

Exchange 2016 and 2019 ended extended support October 14, 2025, and the last ESU window closes in 2026 with Microsoft stating no further extensions. What still runs, what it risks, and the two realistic paths: Subscription Edition or Microsoft 365.

SQL Server 2016 end of life (EOL) and end of support: July 14, 2026, when SP3 extended support ended. Paid ESU runs to July 17, 2029 for some editions.

vSphere 7.x general support ended October 2, 2025, perpetual licenses are gone, and every ESXi version now runs on a subscription clock. What actually expires and when, what end-of-general-support means, and every realistic path forward.

Windows Server 2012 and 2012 R2 reached end of life October 10, 2023; the last ESU year ended October 13, 2026, on-premises and on Azure. Every date.

On July 14, 2026, SharePoint Server 2016, SharePoint Server 2019, and SQL Server 2016 all reached Microsoft end of support on the same day. What stopped, why the double SharePoint cutoff is unusual, the SQL Server ESU terms, and every path forward.

Debian 12 Bookworm regular security support ended July 12, 2026; Debian LTS runs to June 30, 2028. What stops now, what LTS still covers (and its coverage trap), the Debian 11 double-deadline, and three paths forward.

In June 2026 open-source support ended for Spring Boot 3.5, Spring Framework 6.2, Spring Security 6.5 and Spring Cloud 2025.0 simultaneously — and 3.5 was the last 3.x release. Ranked options for teams on 3.x.

A CVE in your runtime, framework, or a transitive library demands three different responses. Struts/Equifax, Spring4Shell, and Log4Shell show how each layer fails, who ships the fix, and what happens when that layer is end-of-life.

Nothing crashes the day software goes end-of-life — that is the trap. The real timeline of an EOL system: permanent CVEs, ecosystem drift, compliance failures, and the four exits available at each stage.

The plain-English guide to CVEs: who assigns vulnerability IDs, what CVSS scores really mean, why the CISA KEV list outranks everything, the life of a CVE from discovery to mass exploitation — and why end-of-life software turns CVEs into permanent exposure.

The plain-English guide to software dependencies: direct vs transitive packages, what semver ranges and lockfiles really do, the left-pad and Log4Shell lessons, and how SBOMs and lifecycle checks reveal the code you ship without reading.

The plain-English guide to Long-Term Support: what LTS actually promises, the release rhythms of Node.js, Java, Ubuntu, .NET and major frameworks, why LTS is not forever — and how to plan upgrades around published support windows.

Angular moved to one major release a year with Angular 22 (June 3, 2026): 12 months of active support plus 12 of LTS. Angular 19 reached end of life May 19, 2026; Angular 20 ends November 28, 2026. Every Angular version's dates from 9 to 22, live Risk Scores, the ng update path and extended-support options.

Bootstrap 5 is the only maintained line. Bootstrap 4 reached end of life on January 1, 2023, Bootstrap 3 on July 24, 2019 and Bootstrap 2 long before; old Bootstrap also drags end-of-life jQuery and known XSS into a site. Every version's dates, live Risk Scores, and the path to Bootstrap 5.

Ember 7.3 is the current release; 6.12 LTS and 6.8 LTS are the supported long-term lines, ending May 25, 2027 and December 8, 2026; everything through 6.4 LTS is end of life. Every tracked version with release, LTS, bug-fix and end-of-life dates, the 36/54-week LTS policy, the Octane shift, and the ember-cli-update path.

jQuery core is not end of life: 4.x is current and 3.x receives critical security patches and bug fixes. What is: jQuery 1.x and 2.x (no releases since 2016), jQuery UI 1.13 (ended August 5, 2024 when 1.14 shipped; the project is in a maintenance state) and jQuery Mobile. Every version's dates, the known XSS in old jQuery, and how to fix it.

An original data report across 459 tracked technologies: 32 are tied to actively-exploited vulnerabilities, 30 score Critical, and 190 have a release reaching EOL in 2026. Methodology, full data tables, and the 2026 EOL calendar.

Vue 2 reached end of life on December 31, 2023. Vue 2.7 was the final release. The EOL Risk Score, why Vue 2 still matters, the Vue 3 migration path, and extended-support options.

AngularJS reached end of life on December 31, 2021 across every version. The EOL Risk Score, why it still matters, migration paths, and extended support options.

PostgreSQL 14 reaches EOL November 12, 2026. PostgreSQL 13 is already EOL. The 5-year support policy, every PostgreSQL version EOL date and EOL Risk Score.

MySQL 8.0 reached end of life in April 2026 (RDS standard support ended July 31; Azure ends December 31). MySQL 8.4 LTS runs to April 2032; MySQL 9.7 LTS, released April 21, 2026, to April 2034; 9.0–9.6 Innovation releases are all dead. Every version's date, the managed-service clocks, how to check your version, and what to do.

Ubuntu 25.10 (Questing Quokka) reached end of life on July 1, 2026. No more security patches since that date. Upgrade path, who is affected, and everything to do before the deadline.

.NET 8 (LTS) and .NET 9 (STS) both reach end of support November 10, 2026; .NET 10 (LTS) runs to November 14, 2028. Every .NET version's dates.

The 2026 software EOL reference: end-of-life dates for the 100+ most-queried versions — Windows, Ubuntu, Debian, RHEL, Node.js, Python, PHP, Java, PostgreSQL, Kubernetes, Spring Boot, and more. Updated daily.

GPT-3.5 Turbo is legacy. Snapshot gpt-3.5-turbo-0613 retired September 13, 2024; gpt-3.5-turbo-0301 was deprecated June 13, 2023. The full retirement timeline and what OpenAI recommends instead.

ROS Noetic Ninjemys reached end of life May 1, 2025 — and with it, ROS 1 itself. What Noetic EOL means for robotics teams and the migration path to ROS 2.

The plain-English guide to software end of life: what EOL, EOS, LTS, CVE, and every other acronym actually mean — plus what runtimes, frameworks, and libraries are, and why their support dates matter.

Oracle 19c Premier Support ends Dec 31, 2029 (Extended to 2032). Oracle 12c, 11g, and 18c are all past support. Every Oracle Database EOL date and support phase.

endoflife.ai now adds any product's end-of-life date to your calendar with reminders 90, 30, and 7 days out. Why that lead time is required by PCI DSS, ISO 27001, and SOC 2.

Just found out your software is end-of-life? Exactly what to do — understand your risk, assess your options, and decide your next move. For developers and IT teams.

GPT-4 Turbo, Gemini 2.0, Llama 3, Mistral Large — all deprecated or on a countdown. The complete 2026 AI model deprecation timeline with exact shutdown dates and EOL Risk Scores.

CentOS 7 reached EOL June 30, 2024. CentOS 8 reached EOL December 31, 2021. All CentOS Linux versions are now unsupported. Migration options: AlmaLinux, Rocky Linux, RHEL.

Apache Kafka has no formal end-of-life calendar: the community cuts bug-fix releases for the last three feature releases, about a year, and a version is superseded when the next one ships. Kafka 3.8 ended November 6, 2024; 3.9 (the last ZooKeeper-capable release) and the 4.x line are current. Every version with release and end-of-life dates, the KRaft migration, and what to do when patches stop.

Rails 6.1 EOL June 2024. Rails 7.0 EOL April 2025. EOL Risk Scores and upgrade guidance for every Ruby on Rails version.

Apache Tomcat 9.0.x is still supported: the Apache Tomcat project says end of support is expected no earlier than March 31, 2027. Tomcat 10.1 and 11.0 have no end-of-life date; Tomcat 8.5 died March 31, 2024, 10.0 on October 31, 2022. Every version's dates, live risk scores, the javax→jakarta migration, and what to do.

Veeam 11 reached End of Support on February 29, 2024; Veeam 12 (all 12.x builds) reaches it on February 28, 2027. Upgrade paths for every version.

Node.js 18 reached end of life April 30, 2025. Which vendors offer extended lifecycle support and CVE patches for Node.js 18 past its EOL date?

PHP 8.2 reaches end of life December 31, 2026. Currently in security-only support. Migration guide, live countdown, and vendor extended support comparison.

Ubuntu 22.04 standard support ends May 31, 2027 and 20.04 has already ended. Full Ubuntu EOL date table and extended lifecycle support vendor comparison.

Debian 12 Bookworm regular security support ended July 12, 2026 and Debian LTS runs to June 30, 2028. Your complete action guide: upgrade paths, LTS and ELTS coverage, and the CVE risk of staying put.

Debian 12 (Bookworm) left regular security support on July 12, 2026 and is in LTS until June 30, 2028; Debian 11 (Bullseye) left LTS on August 31, 2026 and has paid ELTS only; Debian 13 (Trixie) is current, with regular support to August 9, 2028. Every Debian release with release, regular-support and LTS dates, the three support tiers, and what to do when patches stop.

Cisco IOS-XE EOL dates by release — 17.3, 17.6, 17.9, 17.12, 17.15 and beyond. Running EOL IOS-XE means unpatched network infrastructure CVEs. EOL Risk Scores for every release.

RHEL 7 reached EOL June 30, 2024 — no more standard CVE patches. The complete RHEL EOL timeline plus the support options that keep patches flowing: Red Hat ELS or its 2026 Extended Life Cycle Premium and Long-Life Add-On, third-party support, or migration.

Django's LTS and standard release cadence creates a complex EOL landscape. Every Django version support status and EOL Risk Score.

MariaDB 10.6 LTS reached end of life July 6, 2026; 10.11 runs to February 16, 2028, 11.8 to June 4, 2028, 11.4 to May 29, 2029, and the newest LTS, 12.3 (May 28, 2026), to June 12, 2029. Rolling releases (12.0–12.2) live about three months each. Every version's dates and live risk scores, LTS vs rolling explained, and how to upgrade.

Spring Boot 3.5 OSS support ended in June 2026 and 4.0 ends in December 2026; 4.1 runs to July 2027. Every Spring Boot version from 1.5 to 4.1 with OSS and commercial support dates, the release cycle, the Spring Framework mapping, and what to do when patches stop.

Kubernetes 1.33 reached end of life on June 28, 2026 and 1.32 on February 28, 2026; 1.34 is in maintenance mode until October 27, 2026; 1.35, 1.36 and 1.37 are supported. Every Kubernetes minor with release, maintenance-mode and end-of-life dates, the 14-month rule, the EKS, GKE and AKS clocks, and what to do when patches stop.

React has never published an EOL date. React 18's last release was April 2024; React 19 is current. Every version's support status, last release, and upgrade path.

Running EOL software is a compliance violation. How EOL software triggers findings under major compliance frameworks.

Developers shipping EOL dependencies are creating compliance liability. What you need to know about your compliance obligations.

Running EOL software is a compliance violation under SOC 2, PCI DSS, ISO 27001, and more. How EOL Risk Scores map to compliance control failures and audit findings.

Node.js 14 reached end of life April 30, 2023. No more CVE patches, no security fixes. Your risk score, the vulnerabilities you are exposed to, and how to upgrade.

Spring Framework 6.2 reached open-source end of life in June 2026, 6.1 in June 2025, 6.0 in June 2024 and 5.3 in August 2024; only 7.0 is supported, to July 2027. Every version from 3.2 to 7.0 with OSS and commercial support dates, the Spring Boot mapping, and what to do when patches stop.

PHP 8.1 reached end of life December 31, 2025; PHP 8.2 ends December 31, 2026 and 8.5 runs to December 31, 2029. Every PHP version's EOL date.

Python 3.9 reached end of life October 31, 2025 and 3.10 on October 1, 2026. Every Python version's EOL date, risk score and upgrade path.

The EOL Risk Score is a 0–100 proprietary rating built from four factors: EOL recency, attack surface, CISA KEV presence, and extended support availability. Full methodology explained.

Node.js 20 reached end of life April 30, 2026; Node.js 22 is supported until April 30, 2027 and Node.js 24 until April 30, 2028. Dates for every version.

Most SAST, DAST, and SCA tools do not flag EOL software until after exploitation. The gap in your security toolchain.

Unpatched EOL software is the most common vector in enterprise breaches. How to quantify and eliminate the CVE blind spot in your stack.

Hardware EOSL is the overlooked cousin of software EOL. When your infrastructure goes unsupported, the risk profile changes dramatically.

A practical framework for CISOs to assess, score, and prioritize end-of-life software risk using the EOL Risk Score methodology.

Windows 10 22H2 reached end of support October 14, 2025. Consumer ESU ends October 12, 2027 (extended by Microsoft on June 25, 2026); commercial ESU year 1 ended October 13, 2026 — the same day Windows 11 24H2 Home/Pro ended — and runs to October 10, 2028 at US$61/$122/$244 per device. LTSC 2021 to January 2027, LTSC 2019 to January 2029. The migration guide, the ESU table, and how to tell which build you are on.

PHP 7.x and Node.js 16 are still running on millions of production servers years after EOL. What that means for your security posture.

A deep dive into the EOL Risk Score methodology — the four factors, the weighting, and why this scoring model gives security teams actionable signal.

The 50 most widely deployed software products reaching end of life in 2026, ranked by EOL Risk Score. Is your stack on this list?

Every dated end-of-support event between August and December 2026: OpenSSL 3.0, Oracle JDK 17 Premier, Windows Server 2012 final ESU, Python 3.10, .NET 8/9, PostgreSQL 14, PHP 8.2 — month by month, every row linked and risk-scored.