Securing Legacy Systems: Where to Start (2026 EOL Guide)

"Our system is old. Is it still safe?" If you are asking yourself this, the first step is to list what is running and compare each part with its end-of-support date. Tackle what has already expired or is about to, and you can make progress safely without wasted effort.

This guide is for owners and managers without an IT background: what to do first, and in what order.

Why are old systems risky?

A system runs on several layers stacked on top of each other. When any one layer goes out of support, the whole system is at risk.

Server OSThe base software

Language and runtimeJava, .NET, etc.

Frameworks and librariesReady-made building blocks

Your business systemWhat your team uses daily

When any of them goes out of support, these problems become likely:

Key end-of-support dates for 2026–2027

We focused on software common in small and mid-sized companies (from official sources; dates may change).

Dates for Microsoft products (.NET, Windows Server) are in US time.

The deadlines still ahead, in order:

• 10 November 2026
  .NET 8 and .NET 9 reach end of support
• 12 January 2027
  Windows Server 2016 reaches end of support
• End of March 2027
  Ruby 3.3 reaches end of support (planned)
• 30 April 2027
  Node.js 22 reaches end of support (planned)

Node.js and Java both had major security updates in October 2026. See the Node.js security release and the October 2026 Java alert for details.

Where to start: six steps

Here is the overall flow. Rather than changing everything at once, it is safest to start with the riskiest parts.

STEPS 1–2Know1. List what is running
2. Compare with support dates

STEP 3Decide3. Set priorities

STEPS 4–6Act4. Shore up defences
5. Plan the upgrade
6. Review regularly

1. List what is running

   For each system, write down the items in the table below. Ask your developer or maintenance provider about anything you don't know.

2. Compare with support dates

   Add an end-of-support date next to each item. You can find them in the table above or on each vendor's official page.

3. Set priorities

   Decide by whether a system is public, whether it is out of support, and whether it handles personal data or payments (Figure 3).

4. Shore up defences now

   Apply available fixes, stop exposing unused features, and so on. Start with what costs nothing.

5. Plan the upgrade

   Move the OS, language and framework to newer versions, in this order: assess, switch in a test environment, check it works, switch production, monitor.

6. Review regularly

   Even where support has time left, review the list regularly so the next deadline doesn't catch you out.

Your list should include items like these:

Use these guidelines to set priorities:

High Act now

Public on the internet and out of support. Handles customer personal data or payments.

Medium Plan within months

Public, and support ends within a year. Internal only, but out of support.

Low Review regularly

Plenty of time left before end of support.

The quick defences in step 4 are:

• Apply any available fixes (patches) first.
• Stop exposing unused screens and features, and anything that does not need to be public.
• Check that backups exist and can actually be restored.
• Review admin passwords and who has access.

Leave it, or act?

No documentation, and the original developer is gone?

With old systems, these worries are very common:

There is no need to give up. Reading the code shows what a system does. Along the way, the feature list, screen list and data flows can be documented again. To get started, check that you have the following:

• The source code
• Administrator logins for servers and cloud accounts
• Domain (website address) registration details
• Database backups
• Contracts for outside services (email delivery, payments, etc.)

How Digi Dinos can help

Digi Dinos is a software company with offices in Vietnam and Japan. Over eight years we have delivered more than 150 projects, with a Japanese-speaking team.

• Taking over maintenance of existing systems in all major stacks: PHP, Java, Node.js, Python, Ruby, .NET and more.
• Fixing newly published vulnerabilities: when a new weakness is announced, we check the impact and apply the fix.
• Full upgrades: language runtime, framework, server and operating system.
• No documentation? No problem. Even when the original vendor has gone and nobody understands the business logic, we read the code, rebuild the documentation and propose a complete plan.
• Lifetime warranty: if a defect turns up in anything we worked on, we fix it, with no end date for as long as your maintenance contract continues.

FAQ