What does end of life (EOL) mean for software, and is it still safe?

The short version

• End of life (EOL) means the maker stops fixing the software. No more security fixes.
• It still works. Nothing breaks on the date, so nobody notices.
• The risk grows over time, because every flaw found afterwards stays open.
• Other things stop working with it: new plugins, new hosting, card payment rules, insurance questions.
• Plan the move before the date. The EOL tracker lists the dates that matter to small businesses.

What does end of life actually mean?

Most software has a published support life. During it, the maker fixes bugs and security holes. At the end, the fixes stop.

The stages usually look like this:

The PHP dates come from PHP.net’s supported versions and unsupported branches pages. Microsoft publishes the same kind of dates on its lifecycle pages.

Not every maker publishes a date. WordPress says only its latest major release is officially supported, and older versions get fixes only as a courtesy, with no fixed period (WordPress.org). Apple doesn’t announce end dates for macOS or iOS. Its security releases page shows which versions got the latest fixes. In October 2026, that was macOS 27, 26 and 15.

Why does “it still works” not mean “it’s safe”?

On the end-of-life date, the software is exactly as safe as it was the day before. The difference is what happens next.

Researchers and criminals keep finding flaws in old software. For a supported version, each flaw gets a fix. For an end-of-life version, it doesn’t. So the list of known, open holes only grows. Every month you stay, the gap between your version and a safe one gets wider.

A real example: on October 21, 2026, the PHP project fixed two critical flaws that could let an attacker run code on a web server. Fixed versions came out for PHP 8.2 to 8.5. The advisory said PHP 8.1 and older no longer get updates from the project, and pointed owners to their host or a paid support vendor. The team also published bare-bones fixes for 7.4, 8.0 and 8.1 because the flaws were so serious, but sites on those versions depended on their host to apply them.

Why does the risk grow over time?

• More known flaws. Each one found after the end date stays open.
• Easier attacks. Once a flaw is public, tools to exploit it spread, and scanning for old versions is cheap.
• Fewer people who can help. Developers stop testing on old versions, so fixes for your own site get harder and dearer.
• Bigger jumps. Moving one version is a small job. Moving four at once is a project.

What can end-of-life software break?

The security risk is the main one. These are the practical ones owners run into:

• Hosting moves. Good hosts stop offering end-of-life PHP. Moving host, or a host’s forced upgrade, can break a site that was never tested on a newer version.
• Plugins and themes. New plugin versions stop installing on old PHP or old WordPress. You end up stuck on old plugin versions too, with their own open holes. WordPress 7.0, for example, dropped support for PHP 7.2 and 7.3; see which PHP version your site should run.
• Payments. If you take cards, the card industry’s security standard (PCI DSS) expects systems to be protected against known vulnerabilities. Software that no longer gets fixes makes that hard to show. Your payment provider can tell you what applies to you.
• Insurance and contracts. Insurers and larger customers increasingly ask whether your systems still get security updates. See what cyber insurance asks.
• Office computers. Windows 10 reached end of support on October 14, 2025 (Microsoft), and Office 2021 on October 13, 2026. New apps and printers stop supporting them over time.

What should I do?

1. List what you run. Website (PHP, WordPress, plugins), office computers (Windows or macOS version), Office, phones, any server in the office.
2. Check each against the dates. The EOL tracker has the common ones, each with its source.
3. Plan upgrades before the date, not after. For a website, test on a staging copy first.
4. Replace what can’t be upgraded. An old computer that can’t run a supported Windows or macOS, or a plugin nobody maintains, needs replacing.
5. Use paid extensions only as a bridge. Microsoft’s Windows 10 Extended Security Updates for consumers run until October 12, 2027. That’s time to plan, not a fix.

What are the common mistakes?

• Waiting for something to break. With EOL, nothing visibly breaks until there’s an incident.
• Thinking the host handles everything. Many hosts patch the server, but if your site is pinned to an old PHP version for a plugin, it stays there.
• Upgrading straight on the live site. Test first, so the upgrade doesn’t take the site down.
• Forgetting the small stuff. Old browsers, old routers and old phones count too.

How long does it take?

Checking takes minutes. Upgrading PHP on a small, well-kept WordPress site is usually an hour or two with testing. A site several versions behind, or with abandoned plugins, can take days. Replacing an office computer is a purchase and an afternoon of setup.

How does E-3 handle this?

E-3 keeps the sites it hosts on supported PHP versions. Monitoring tracks each hosted site’s PHP version, waiting updates and known plugin vulnerabilities. Updates are tested on a staging copy first, and we send security alerts and keep daily backups. Office computers and phones are outside what we look after, so put them in your security plan.

Related questions

• Why do WordPress, plugin and PHP updates matter?
• Is my site on an old PHP or WordPress version?
• What PHP version should my WordPress site run?
• How do I secure office computers, phones and Wi-Fi?
• The end-of-life tracker

Sources

1. Supported versions (PHP.net)
2. Unsupported branches (PHP.net)
3. PHP news archive 2026: Security advisory, October 21, 2026 (PHP.net)
4. Supported versions (WordPress.org Documentation)
5. Requirements (WordPress.org)
6. Ending support in 2026 (Microsoft Lifecycle)
7. Windows 10 Home and Pro (Microsoft Lifecycle)
8. Windows 10 Consumer Extended Security Updates (Microsoft)
9. Apple security releases (Apple Support)
10. PCI Data Security Standard (PCI Security Standards Council)