Topic
Products past their vendor support date, for which no security fixes are issued regardless of what vulnerabilities are found in them.
Hitachi Energy will not patch six flaws Dragos reported in end-of-life RTU500 CMU firmware, and says releases up to 11.x are likely affected. Energy operators still on those versions have to upgrade to supported firmware or isolate the units.
Reality
ISC fixed fourteen flaws in BIND 9.20.29 and 9.21.26, with no workarounds for any of them. The unauthenticated crash is one of only two that never reached the end-of-life 9.18 branch.
Reality
IdentityServer4 stopped getting patches in 2022 and its repository is now read-only. The two replacement paths closest to its codebase both put the admin UI behind a separate licence, priced in different currencies.
Reality
Proxmox says multiple independent reports have attackers using PSA-2026-00043-1 to encrypt data for extortion. A port-8006 query returns 4,043,230 hosts; the Proxmox VE fingerprint returns 34,219, a factor of about 118 apart.
Reality
AI-assisted code analysis keeps finding old bugs in software that certified and unsupported OT cannot update. Talos answers with deep packet inspection on the path in and VLAN segmentation built on how little OT talks.
Reality
Root Evidence rebuilt the exploitation clock on vendor advisory dates rather than NVD publication, and Jeremiah Grossman's team reads the resulting four-month median as a measure of inventory that stopped being maintained.
Reality