End-of-life software: the risks and a checklist
Short answer: end-of-life software no longer gets updates from its maker, including security fixes. Running it means any newly found flaw stays open. CISA recommends retiring all EOL products, and the UK's NCSC says the only fully effective mitigation is to stop using the obsolete product.[1][4]
What is end-of-life software?
CISA describes end-of-life software as software whose vendor has discontinued support or updates.[1] Vendors use different terms, such as end of life, end of support, end of mainstream support or extended support. Read each vendor's definition: the date that matters most is the last day you can get security fixes.
Some vendors sell extended support after mainstream support ends. NCSC notes that extended-support products may not get fixes for every known vulnerability and may need manual updates, so it recommends migrating once mainstream support ends.[5]
What are the risks of end-of-life software?
- Unpatched vulnerabilities. Once updates stop, flaws found later stay exploitable. NCSC says they become exploitable by relatively low-skilled attackers over time.[4]
- Missing modern defenses. Older products may lack newer security measures, which makes exploitation more likely to succeed and harder to detect.[4]
- Compatibility and productivity problems. CISA notes unsupported software can cause compatibility issues and reduced performance.[1]
- Regulatory and customer scrutiny. CISA lists using unsupported software for critical infrastructure as an exceptionally risky "bad practice", especially for technology reachable from the internet.[2]
- Forced, rushed upgrades. When a critical flaw lands on an EOL version, there may be no patch at all. In October 2026, CISA told organizations still on PHP 8.1 or earlier to take PHP-based systems offline until patched or updated.[7]
End-of-life software checklist
- Inventory what you run. Operating systems, language runtimes (PHP, Python, Node.js, Java), databases, frameworks, CMS platforms, plugins, appliances and cloud services. NCSC says asset management is how you see end-of-support dates coming.[6]
- Record each item's support dates from the vendor's own lifecycle page, not from memory or a third-party summary.
- Flag what's already EOL or within 12 months of it. Mark extended-support items separately, as NCSC suggests.[5]
- Prioritize by exposure and impact. Internet-facing systems and systems holding sensitive data come first.
- Plan the migration before the deadline. NCSC advises planning migrations as support end dates approach.[3]
- Mitigate what you can't replace yet. Segregate it from the rest of the network, limit untrusted content reaching it, limit what it can access, and monitor it closely. Revisit the decision regularly.[3][4]
- Keep patching everything around it. Even if one component is obsolete, keep the rest updated.[3]
- Remove what's retired. If a product is end-of-life or can't be updated against a known exploited vulnerability, CISA's guidance is to remove it from the network.[8]
What are examples of end-of-life software right now?
- PHP 8.1 and older (PHP 8.1 reached end of life on Dec 31, 2025). PHP 8.2 follows on Dec 31, 2026. See PHP end-of-life dates.
- Retired AI models. Cloud AI providers retire model versions on published schedules. ModelEOL tracks Amazon Bedrock model retirement dates.
Find your own: check each vendor's lifecycle page for the products in your inventory.
Why does end-of-life software linger?
Usually because nobody owns the upgrade. The system works, the upgrade has no visible payoff, and the risk is invisible until a critical flaw is announced. Treat lifecycle dates like contract renewals: put them on a calendar, assign an owner, and budget for the upgrade before the date, not after. That's the core of tech debt remediation.
Frequently asked questions
What is the difference between end of life and end of support?
Vendors use the terms differently. Both generally mean the vendor stops some or all updates. Check the vendor's definition for the date security fixes stop.
Is it illegal to use end-of-life software?
Not in general. But CISA calls it an exceptionally risky practice for critical infrastructure, and contracts or regulations in your industry may require supported software. Check with your compliance team.
Is extended support a good alternative to upgrading?
It can buy time. NCSC notes extended support may not fix every vulnerability and recommends migrating to a supported version.
How do I find end-of-life software in my company?
Start with an inventory of operating systems, runtimes, applications and appliances, then look up each vendor's lifecycle dates. Prioritize internet-facing systems.
Sources for this page
- CISA: Understanding Patches and Software Updates
- CISA: Bad Practices
- NCSC (UK): 10 Steps to Cyber Security, vulnerability management
- NCSC (UK): Obsolete products
- NCSC (UK): Vulnerability management, identify assets
- NCSC (UK): Asset management
- CISA: Critical Vulnerabilities in PHP Require Immediate Patching (Oct 21, 2026, revised Oct 23)
- CISA: Reducing the Significant Risk of Known Exploited Vulnerabilities