Hourglass

Is your website running on borrowed time?

Our Technical Director, Emmanuel Tissera, gives his perspective on end-of-life software and the risks it presents.

Emmanuel Tissera

27 May 2025

8 minute read

As the Technical Director here at Luminary, I'm always looking ahead, exploring the innovations that can propel our clients' digital strategies forward. But just as important as embracing the new, is thoughtfully managing what's already in place. It's a conversation we have regularly with many of our clients: the status of your website's underlying software.

While it might not be the most exciting topic, understanding the implications of end-of-life (EOL) software for your Content Management System (CMS) and its supporting technologies is crucial. Understanding these risks is paramount to maintaining robust and secure digital foundations ready for the future, preventing exposure to unnecessary vulnerabilities, and avoiding potentially significant financial repercussions – including legal ramifications from privacy breaches and regulatory non-compliance.

Cost of data breaches

Large organisations in Australia have not been immune to data breaches. The Optus and Medibank data breaches are two of the worst in recent history.

The 2022 Optus data breach prompted Optus to allocate $140 million for costs such as replacing compromised IDs and providing credit monitoring. ACMA initiated Federal Court proceedings against Optus for allegedly failing to protect customer data in at least 3.6 million instances, potentially incurring a $900 million penalty. The OAIC is also investigating Optus's compliance with Australian Privacy Principles.

In December 2022, Medibank, a private health insurer, experienced a significant data breach impacting 9.7 million customers. The OAIC is investigating Medibank's privacy practices and has commenced Federal Court proceedings, alleging the company failed to take reasonable steps to protect personal information. While a theoretical $21 trillion penalty has been cited, the potential fine is likely to be capped at $2.2 million per contravention, as the incident occurred before penalty increases. Additionally, APRA directed Medibank to allocate $250 million in capital due to identified security vulnerabilities.

As financial repercussions from data breaches can range from hundreds of millions to theoretically trillions of dollars, it is prudent that organisations take necessary steps to safeguard their data including upgrading their EOL software.

The inevitable lifecycle: What EOL really means

Every piece of software has a lifecycle. Just like any product, from your smartphone to your car, there comes a point when vendors shift their focus from older versions to newer, more advanced offerings. When your CMS, its core development framework, or even the operating system it runs on reaches its end-of-life, the vendor discontinues official support.

This isn't to say your website will suddenly stop working the day after EOL. However, it does mean a critical change – no more security patches, no more bug fixes, and no dedicated technical assistance. This isn't a problem unique to any single platform; it's a universal truth in the world of software.

Unseen vulnerabilities: A growing security concern

Think of it this way: your website is a digital storefront, and EOL software is like leaving the front door unlocked. Cybercriminals actively scan the internet for known vulnerabilities in unsupported software because they know these weaknesses won't be addressed. Without those essential, vendor-supplied security updates, your digital presence becomes increasingly susceptible to breaches, data theft, and other malicious activities.

From our perspective, it’s about proactive risk management. We want to help you prevent issues before they arise, and relying on unsupported software introduces an escalating degree of preventable risk.

In today's landscape, a breach could trigger mandatory reporting obligations under Australian law, and frankly, nobody wants to face the reputational and financial fallout that comes with it.

Navigating the regulatory landscape

Beyond the inherent security risks, there are significant compliance considerations, especially here in Australia, for any organisation handling sensitive data.

For businesses processing cardholder information, PCI Data Security Standard (PCI DSS) Requirement 6 is explicit: it mandates that secure systems be developed and maintained, with timely patching of known vulnerabilities. If your CMS or its environment is EOL, adhering to this standard becomes incredibly challenging, potentially leading to audit failures, fines, and even the suspension of card processing capabilities.

Closer to home, the Australian Privacy Principles (APPs), particularly APP 11, require organisations to take "reasonable steps" to protect personal information. Continuing to operate an outdated and unpatched system can be seen as failing in this duty. Such vulnerabilities are what we refer to as low-hanging fruit for cybercriminals, increasing the likelihood of a data breach. In today's landscape, a breach could trigger mandatory reporting obligations under Australian law, and frankly, nobody wants to face the reputational and financial fallout that comes with it.

What might seem like a cost-saving measure in the short term, by avoiding an upgrade, can paradoxically lead to higher long-term expenses.

Impact on productivity and innovation

While security and compliance are paramount, it’s also worth considering the operational ripple effects. Our team works with modern tools and technologies that foster efficiency and creativity. Older, EOL platforms often rely on legacy codebases and development methodologies that can slow down progress, make it harder to implement new features, and even impact our ability to attract and retain the best digital talent for your projects.

What might seem like a cost-saving measure in the short term, by avoiding an upgrade, can paradoxically lead to higher long-term expenses. We've seen situations where bespoke workarounds become necessary for basic functionality, or critical system instabilities arise, requiring costly emergency interventions. Investing in a current platform often means investing in a more stable, efficient, and future-ready environment for your digital assets.

Protecting your digital future

Ultimately, our goal as your digital partner is to help you thrive online. This involves not just building beautiful, effective websites but also ensuring they stand on solid ground. Any personally identifiable information (PII), financial data, or other sensitive details stored or processed on an EOL system faces a heightened risk of compromise. Maintaining trust with your audience is invaluable, and a security incident can quickly erode it.

We understand that platform upgrades can feel like a significant undertaking. However, considering the escalating risks – from security threats and regulatory penalties to operational inefficiencies – the conversation around modernising your digital foundation is a vital one. It's about proactive planning, smart investment, and building a secure, sustainable digital future for your organisation. We're here to guide you through these considerations and explore the most effective path forward.

Platform specific recommendations

In terms of the platforms we work with, here are some of the versions that are nearing EOL and some steps you can take to rectify the situation.

Skip ahead to read about:

Kentico

Kentico versions below 12.x reached end of life on 31 December 2023. Kentico version 13 will reach end of life on 31 December 2026 and teams will need to start planning to upgrade to Xperience By Kentico (XbyK) in the 2025/26 financial year. Some versions of Kentico (for example v10.0.52) use a .NET framework v4.5.2 that also reached end of life on 26 April 2022.

The last hotfix released by Kentico for version 12.x and lower was on 3 July 2023. Comparatively, the currently supported 13.x version released a hotfix for v13.0.186 on 15 May 2025.

See https://www.kentico.com/services/support/support-lifecycle for more details on supported product versions. 

Optimizely

Optimizely CMS does not publicly publish EOL dates for current products such as Optimizely CMS versions 11 and 12. But for Optimizely Content Cloud (CMS) prior to version 10, End of Sale (EoS) sunset was June 2020 with an extended security update (ESU) valid until June 2023. Similarly, Episerver CMS prior to version 7 has an End of Service Life (EoSL) of December 2020 with ESU valid until December 2023. Ektron CMS version 9.3 and below has End of Service Life (EoSL) of July 2024. See more details on Optimizely discontinued services and products.

Looking at the Optimizely CMS (formerly EpiServer CMS) versions 10, 11 and 12, latest hotfixes were released on 19-May-2018, 23-January-2024 and 13-May-2025 respectively. This makes it a compelling reason to upgrade to version 12 with hotfixes released less than 14 days prior to the publication of this article.

Umbraco

Umbraco releases a major version twice per year. Long-term supported (LTS) versions have a life span of three years and align with LTS versions of the underlying .NET framework. But standard-term supported (STS) versions only have a life span of two years.

This makes it a little bit confusing as to which versions are in support and which are out of support. Umbraco version 9 and below are all out of support since December 2022. Umbraco versions 11 and 12 are also out of support since June 2024.

But Umbraco 10 (LTS) reaches EOL in June 2025 and Umbraco 14 (STS) reaches EOL on 30 May 2025.

Looking at Umbraco hotfixes, the last hotfix was released in May 2024 for versions out of support while in-support versions had a hotfix released on 6th of May 2025 (that’s 21 days before this article was published).

We recommend upgrading all of the above versions to Umbraco 13 (LTS) that has a EOL in December 2026. From November 2025 onwards, we recommend using Umbraco 17 (LTS) that has a EOL in November 2028.

See Umbraco Long-term Support (LTS) and End-of-Life (EOL) for more details on Umbraco’s support policies.

Sitecore

Mainstream support for Sitecore versions 10.2 and below ended in December 2024. Extended support ended for version 9.1 in December 2024 and sustaining support ended for Sitecore version 8.1 in December 2023. As an enterprise platform, Sitecore support has mainstream support for three years, extended support for six years and sustaining support for eight years. Extended and sustaining support have cost implications that make upgrading to the mainstream support version cost effective. Upgrading and maintaining your website on Sitecore 10.4 makes sense as it was initially released in April 2024 and has a mainstream support date of December 2027.

The latest cumulative hotfix for Sitecore is v 10.4.1 rev. 011941 that was released in September 2024 and should be applied to keep your Sitecore website secure.

Consolidating your security

In addition to upgrading your CMS version to the latest hotfix, the underlying technology, hosting environments, build tools and third party libraries should be updated to truly secure your website. At Luminary, we use tools such as Snyk to make sure that we scan your website code on every change and periodically to assist with securing it. If your website is running on borrowed time, feel free to come and talk to us. 

Main image: Jordan Benton on Pexels

Keep Reading

Want more? Here are some other blog posts you might be interested in.