Legacy technology radar
The platforms, frameworks and products that business systems still run on, placed on a ring by where they stand today. The ring comes from the vendor's own support dates wherever there are any; the sentence beside each item is what we would say if you asked. October 2026 edition, rebuilt whenever the dates change.
The rings
- Supported 10
- In vendor support with a future: fine to build on, keep current.
- Hold 8
- Still supported, but going nowhere: no new work on it, and a plan for what replaces it when the application next needs major change.
- Plan the move 5
- Security fixes stop within a year. Decide the route now, before it is forced.
- Retire 24
- Out of vendor support: no security fixes. Move off it, or isolate it and accept the risk knowingly.
Status as of 3 October 2026. Dots are placed by ring and quadrant only; position within a ring carries no meaning.
Platforms
| # | Technology | Ring | Why | Our view |
|---|---|---|---|---|
| 1 | Windows Server 2019 | Supported | Supported until 9 January 2029. | Fine for now; plan to skip to 2025 when it is next rebuilt. |
| 2 | Windows Server 2022 | Supported | Supported until 14 October 2031. | The sensible target for a server being rebuilt today, with 2025 close behind. |
| 3 | SQL Server 2017 | Supported | Supported until 12 October 2027. | A year of security fixes left. Move with the server, not separately. |
| 4 | SQL Server 2019 | Supported | Supported until 8 January 2030. | Supported to 2030; a reasonable place to be, but a new install should go to 2022. |
| 5 | SQL Server 2022 | Supported | Supported until 11 January 2033. | The version to install today. |
| 6 | .NET 10 | Supported | Supported until 14 November 2028. | The current long-term support release and the target for new work and migrations. |
| 7 | PHP 8.4 | Supported | Supported until 31 December 2028. | Supported to the end of 2028. |
| 8 | .NET Framework 4.8 | Hold | Supported for as long as the Windows version it is installed on. No new features. | Supported for as long as Windows is, but frozen: no new features and a growing list of packages that no longer ship for it. Nothing new should start here. |
| 9 | Windows Server 2016 | Plan the move | Security fixes end 12 January 2027. | Security fixes end in January 2027. Anything still on it needs a dated move to 2022 or 2025. |
| 10 | .NET Framework 4.6.2 | Plan the move | Security fixes end 12 January 2027. | Fixes end in January 2027; 4.8 is a small step and buys years. |
| 11 | .NET 8 | Plan the move | Security fixes end 10 November 2026. | Long-term support until November 2026, when 10 takes over. Plan the step to 10 within the year. |
| 12 | PHP 8.2 | Plan the move | Security fixes end 31 December 2026. | Security fixes end December 2026; 8.4 is the target. |
| 13 | Windows Server 2012 R2 | Retire | Security fixes ended 10 October 2023. | Paid extended updates end in October 2026; after that it is an unpatched server on the network. Replace the box, not just the OS. |
| 14 | SQL Server 2014 | Retire | Security fixes ended 9 July 2024. | Out of support; the paid extension runs to 2027. Upgrade in place to 2019 or 2022 is well trodden. |
| 15 | SQL Server 2016 | Retire | Security fixes ended 14 July 2026. | Security fixes ended in July 2026. Every instance, including the Express ones other products installed, needs a plan. |
| 16 | .NET Framework 4.6.1 and earlier | Retire | Security fixes ended 26 April 2022. | Out of support since 2022. Moving to 4.8 is usually a recompile; do it before anything else. |
| 17 | .NET 6 | Retire | Security fixes ended 12 November 2024. | Out of support since November 2024. The move to 8 is small; do it. |
| 18 | PHP 7.4 | Retire | Security fixes ended 28 November 2022. | Out of support since 2022 and the version most legacy PHP sites still run. The jump to 8 needs testing, not rewriting. |
Web frameworks
| # | Technology | Ring | Why | Our view |
|---|---|---|---|---|
| 19 | ASP.NET Web Forms | Hold | Supported as part of .NET Framework 4.8, but not available on modern .NET. | Lives as long as .NET Framework 4.8 and has no path to modern .NET. Keep it patched; plan a replacement of the application, not a port. |
| 20 | ASP.NET MVC 5 and Web API 2 | Hold | Supported, with no path forward. | Supported with .NET Framework 4.8, not available on modern .NET. The controllers and views port to ASP.NET Core with effort that is mostly mechanical; the plumbing (OWIN, membership, bundling) does not. |
| 21 | Classic ASP | Hold | Still runs on IIS as an optional Windows component. No development since 2000. | Still an optional IIS component, with no development since 2000. Treat it as retired code that happens to run: plan the replacement. |
| 22 | Knockout.js | Hold | Supported, with no path forward. | Maintained but minimal, with no end date announced. Fine to keep in an application that works; not where a new front end should start. |
| 23 | AngularJS 1.x | Retire | Security fixes ended 31 December 2021. | Out of support since the end of 2021. Front ends on it accumulate unpatched dependencies; rebuild the front end when the application is next touched. |
| 24 | jQuery 1.x and 2.x | Retire | No longer supported by its maintainers. | No longer supported by the jQuery project. Moving to 3.x is usually a small job with a migration plug-in to flag the breaks. |
| 25 | Bootstrap 3 | Retire | Security fixes ended 24 July 2019. | Out of support since 2019. Harmless on its own, but a Bootstrap 3 layout cannot be upgraded piecemeal; it goes with the next redesign. |
| 26 | Bootstrap 4 | Retire | Security fixes ended 1 January 2023. | Out of support since the start of 2023. Same advice as 3: replace with the next front-end rework. |
| 27 | Vue 2 | Retire | Security fixes ended 31 December 2023. | Out of support since the end of 2023. Vue 3 is close enough that most applications move with a migration build. |
| 28 | Silverlight | Retire | Security fixes ended 12 October 2021. | Out of support since 2021 and will not run in any current browser. Any Silverlight application still in use is already on borrowed hardware. |
| 29 | Internet Explorer 11 | Retire | Security fixes ended 15 June 2022. | Retired in 2022. Applications that need IE mode in Edge should lose that need before Edge loses the mode. |
Desktop, data and integration
| # | Technology | Ring | Why | Our view |
|---|---|---|---|---|
| 30 | Excel VBA as a system | Hold | Supported, with no path forward. | Supported as long as Excel is, which is indefinitely. The risk is not the vendor but the single workbook the business depends on. |
| 31 | Entity Framework 6 | Hold | Supported, with no path forward. | Runs on modern .NET (6.4 and later) and gets fixes, not features. Moving a working EF6 model to EF Core is a separate project; do it when the model changes, not for its own sake. |
| 32 | WCF | Hold | Supported, with no path forward. | Not hosted on modern .NET; CoreWCF keeps existing contracts alive and clients work through the System.ServiceModel packages. New integration goes to Web API or gRPC. |
| 33 | Microsoft Access 2021 | Plan the move | Security fixes end 13 October 2026. | Security fixes end October 2026 for the bought-once version; Microsoft 365 Access rolls on. |
| 34 | Visual Basic 6 | Retire | Security fixes ended 8 April 2008. | The runtime ships with Windows; the tools have had no fixes since 2008 and the pool of people who can change the code shrinks every year. |
| 35 | Visual FoxPro | Retire | Security fixes ended 13 January 2015. | Out of support since 2015. Data and screens migrate; the language does not. |
| 36 | Microsoft Access 2016 and 2019 | Retire | Security fixes ended 14 October 2025. | Out of support since October 2025. An Access front end can stay on a current Office; an Access database shared by several people is the thing to replace. |
| 37 | Xamarin | Retire | Security fixes ended 1 May 2024. | Out of support since May 2024; .NET MAUI is the successor and the migration is mostly project-file surgery for simple apps and a rework for complex ones. |
| 38 | Python 2.7 | Retire | Security fixes ended 1 January 2020. | Out of support since 2020. Scripts move to 3 with automated help; a system built on 2 is a rewrite of its dependencies. |
CMS and front-end libraries
| # | Technology | Ring | Why | Our view |
|---|---|---|---|---|
| 39 | Drupal 10 and 11 | Supported | Supported as long as the site keeps to a current minor release; each minor is supported for about a year. | Supported while the site keeps to a current minor release. |
| 40 | Joomla 5 | Supported | Supported until 12 October 2027. | Supported to October 2027. |
| 41 | WordPress | Supported | In support. | Only the current release is officially supported; the risk sits in the plug-ins. Keep it updating itself and audit the plug-in list yearly. |
| 42 | Drupal 7 | Retire | Security fixes ended 5 January 2025. | Out of support since January 2025 and widely used in the public sector. There is no in-place upgrade: content migrates into a new Drupal 10 or 11 site. |
| 43 | Drupal 9 | Retire | Security fixes ended 1 November 2023. | Out of support since November 2023; the move to 10 is an upgrade, not a rebuild. |
| 44 | Joomla 3 | Retire | Security fixes ended 17 August 2023. | Out of support since 2023. Extensions decide whether the upgrade to 5 is a day or a rebuild. |
| 45 | Joomla 4 | Retire | Security fixes ended 14 October 2025. | Ended October 2025; the step to 5 is small. |
| 46 | Umbraco 7 and 8 | Retire | Security fixes ended 24 February 2025. | Both out of support. Umbraco 8 to a current LTS is an upgrade path; 7 is a content migration. |
| 47 | Apache HTTP Server 2.2 | Retire | Security fixes ended 11 July 2017. | Out of support since 2017. It usually goes with the operating system it was installed on. |
How the radar is made
Every item with a vendor end-of-support date is placed by that date, taken from our end-of-support tables, which are checked against endoflife.date each time the site is published: ended means Retire, ending within a year means Plan the move, and supported means Supported, unless the technology has no path forward (Web Forms, .NET Framework 4.8, Classic ASP), in which case it sits on Hold. Items whose maintainers publish no dates are placed by hand, with the reason stated.
The radar is deliberately about what businesses already run, not what is fashionable. It changes when the dates change: the edition is the month it was built. Quote it freely with a link; the data is also available as JSON.
Most of your estate in the outer rings?
Tell us what runs on what. We will set out the order to tackle it in and what each move is likely to involve.
Tell us about your system 0800 433 7990 Monday to Friday, 9am to 5pm. A first 20-minute call is free, and we reply to every enquiry within one working day. What happens after you get in touch