Legacy System Modernization Before the Patches Stop: .NET 8, PHP 8.2 and Windows Server 2016 in 2026–2027

Short answer: The three critical dates of 2026–2027 are 10 November 2026 for .NET 8 and .NET 9, 31 December 2026 for PHP 8.2, and 12 January 2027 for Windows Server 2016 and .NET Framework 4.6.2. Nothing shuts down on these dates: the server and the application keep running. What ends is the supply of security patches for newly discovered vulnerabilities. Good legacy system modernization follows a sequence, not the calendar: an inventory, the dependency chain, a separate decision for each system (upgrade, migrate, refactor, strangler fig, rewrite or retire) and a phased migration with a rollback plan. Microsoft's Extended Security Updates (ESU) programme is a conditional bridge of up to three years on this path, not a destination.

We wrote this guide for IT managers, CTOs and owners of businesses that run on-premises or hybrid infrastructure. It is also for teams that maintain PHP/Laravel or .NET applications and for anyone preparing the 2027 IT budget, including international companies that run systems in Türkiye or work with Turkish partners. Where a rule applies only in Türkiye, we explain it briefly. We verified the dates against the vendors' lifecycle pages and official announcements. We do not quote prices or give legal interpretations. This article is up to date as of 31 October 2026.

End-of-support calendar 2026–2027: which software stops getting patches, and when?

A note on dates: Microsoft's lifecycle pages show the end date in Pacific Time, as 06:59:59 on the following day ("1/13/2027 6:59:59 AM" for Windows Server 2016). In the table, we use the days given in Microsoft's announcements. For Windows Server 2016, the exact cut-off is 13 January 2027, 17:59:59 Türkiye time (UTC+3). Future dates for open-source projects are plans; for Python 3.11, only the month is known so far.

What does end of support mean? What is a legacy system?

Legacy system: Software or infrastructure that still runs critical work, but whose technology, version or know-how is outdated. It has become hard to change, and its vendor support has often ended or is about to end.

End of support: The date on which the vendor stops providing security updates, bug fixes and technical support for a version. The software keeps running, but new vulnerabilities are not fixed.

For products under Microsoft's Fixed Lifecycle Policy, mainstream support ends first. During extended support, security updates continue at no extra cost. The real break comes on the day extended support ends. After that, security updates are only available through the ESU programme, which Microsoft offers for some products. In open-source projects, the equivalent is the EOL (end of life) date. php.net says that users of an EOL release "should upgrade as soon as possible, as they may be exposed to unpatched security vulnerabilities". Microsoft's .NET support policy is even clearer: "You are strongly recommended to not use out-of-support software."

Do not confuse mainstream and extended support: mainstream support for Windows Server 2022 ended on 13 October 2026, but its security patches continue until October 2031.

Why can "if it ain't broke, don't fix it" get expensive?

Security: Two vulnerabilities known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619; CVSS v4.0 score 9.2; remote code execution without authentication) were fixed with official releases on all supported branches on 21 October 2026. For the end-of-life branches 7.4, 8.0 and 8.1, the PHP security team made an exception because of the severity of the flaws and shared only minimal source code patches (details in our PHP2Shell article). There is no guarantee of that for the next vulnerability.

KVKK: KVKK is Türkiye's Personal Data Protection Law (Law No. 6698); the same abbreviation is used for the national data protection authority. Article 12 of the law requires the data controller to take "all necessary technical and administrative measures to ensure an appropriate level of security" (our translation). The authority's Personal Data Security Guide also notes that some widely used software has documented vulnerabilities, especially in older versions. It counts patch management and software updates among the important elements. The legal assessment is a job for your legal adviser. The technical fact is this: you cannot manage patches on a system that no longer receives any.

Vendor: Support for Microsoft 365 Apps on Windows Server 2016 ended on 14 October 2025. Installations on these servers are frozen at Version 2602 and will receive only security updates until 10 October 2028. If you run Office from a Remote Desktop Services (RDS) server on this version, plan the operating system and Office together.

First step: how do you build a legacy system inventory in 5 working days?

We recommend fitting the inventory into one working week. The goal is not a perfect asset register but a single table that drives decisions. For each system, write down the following:

• Server and operating system: version, physical or virtual, and where it runs.
• Runtime and framework: versions of PHP, .NET, .NET Framework, Node.js, Python and Laravel; package dependencies.
• Database: SQL Server, MySQL/MariaDB or PostgreSQL version.
• Hosting: cPanel/CloudLinux, IIS, an on-premises server or the cloud.
• Integrations: ERP, the e-Fatura integrator (Türkiye's e-invoicing system), virtual POS (online card payments), shipping, marketplaces.
• Licensing: do you have active Software Assurance, subscription licences or SPLA? This decides whether you can get ESU on-premises.
• Business owner: if the system stops, which process stops, and who makes the decision?
• Test coverage: who verifies an upgrade, and how?
• Backup and rollback: when was the last restore test?

Then score each system on two axes: urgency (has support already ended, or are there 6 months, 12 months or longer left?) and business impact (revenue, operations, legal obligations). Systems that score high on both axes form the first wave. The others go into the schedule.

Not one date but a dependency chain: which upgrade triggers which?

One upgrade often triggers another. If you do not see the chain, you will have to work on the same system twice within a year. For databases, the upgrade rules depend on the vendor. MySQL does not support skipping a series when you upgrade between LTS series. MariaDB, by contrast, supports upgrading from older versions straight to the latest one, with no intermediate steps.

Windows Server 2016 end of support: .NET Framework 4.6.2 and SQL Server are in the same chain

Support for .NET Framework 4.6.2 ends on the same day as Windows Server 2016. Versions 4.7 to 4.8.1 have no separate end date: they count as a Windows component, so they follow the lifecycle of the operating system they are installed on. This means that 4.8 on Windows Server 2016 also goes out of support on the same day. According to Microsoft, 4.6.2 and later are in-place updates, and older 4.x applications are expected to run without being recompiled. Still, verify this in a test environment first. .NET Framework is a separate product from .NET 8. If your ERP database runs on SQL Server 2014 or 2016, your ERP vendor's support list decides the target version. Vendors can also change their integration rules (one example is Mikro V17's move to an official API; Mikro is a Turkish ERP vendor).

.NET 8 end of support: move to .NET 10, not .NET 9

In September 2025, Microsoft extended STS (Standard Term Support) from 18 to 24 months. As a result, .NET 9 also ends on 10 November 2026, so moving to .NET 9 does not gain you a single day. The target is .NET 10 LTS (Long Term Support), which is supported until 14 November 2028. Test NuGet package compatibility, breaking changes and your build and deployment pipeline together.

PHP 8.2 EOL: Laravel 12 and the hosting chain

Security support for Laravel 12 ends on 24 February 2027, and Laravel 13 requires PHP 8.3–8.5. For a Laravel 12 application on PHP 8.2, that means two upgrades within two months. Laravel 12 also supports PHP 8.4, so separate the steps: first PHP 8.4, then Laravel 13. On cPanel/CloudLinux, the PHP version is usually selected per account or per domain. Before you upgrade, check your Composer dependencies, encoded modules and PHP extensions.

Rewrite or refactor? Six paths and a decision matrix for legacy system modernization

The right path depends on the state of the system and on how much downtime the business can tolerate:

Four questions decide the path:

1. Are there tests? If not, the first job is to write characterization tests that record the current behaviour.
2. Are the business rules documented, and who has the source code and the know-how? Undocumented rules, a supplier who has left or modules whose source code you do not have all narrow your options.
3. How many integrations and users are there? Each integration is a separate migration test.
4. Which regulations apply? In Türkiye, KVKK and the e-Fatura rules affect how data must be kept during the migration.

If the server is going to move, cloud migration also becomes part of the decision. We cover the balance between off-the-shelf products and custom development in our articles on custom vs off-the-shelf software and custom ERP and CRM. If nobody who knows the system is left, a fractional CTO can lead the decision process.

The strangler fig pattern: renewing a system piece by piece without switching it off

The name comes from an analogy by Martin Fowler. A strangler fig sprouts on a tree. As it takes root and grows, it gradually takes the place of its host. Fowler observes that plans for a one-to-one rewrite of a legacy system fail most of the time. It is hard to work out the details of the current behaviour, and a large part of that behaviour is in fact unwanted. The gradual path needs a transitional architecture that is thrown away once the work is done. In Fowler's view, "the reduced risk and earlier value from the gradual approach outweigh its costs". Microsoft's architecture guidance follows the same idea: a façade (proxy) sits between the client and the two systems, and as features move over, routing shifts to the new system. A hypothetical example:

1. An API gateway is placed in front of an old dealer portal that runs on PHP 8.2. All traffic still goes to the old code.
2. The current behaviour of the order API is recorded with characterization tests and rebuilt in a new service.
3. Using a feature flag, the gateway opens the new order route to pilot dealers first. If there is a problem, the flag is switched off and traffic goes back to the old code.
4. The hardest part is the data: both systems must see the same orders. Synchronization is set up through a shared database or change data capture (CDC), and consistency is verified.
5. The other modules move over one by one. The old portal is switched off last.

What is ESU? Are Extended Security Updates a bridge or a trap?

Microsoft announced ESU for Windows Server 2016 on 25 February 2026; the programme starts on 12 January 2027. Microsoft describes ESU as "a last resort paid option": not a permanent solution, but a temporary bridge while you move to a new platform. The general terms on the ESU FAQ page are as follows (today, the page covers the Windows Server 2012/2012 R2 and Windows 10 programmes):

• Duration and scope: up to three years after the end of extended support; only Critical and Important security updates, with no general technical support.
• On Azure: free on Azure virtual machines.
• On-premises: paid, either pay-as-you-go through Azure Arc or yearly through Volume Licensing. Active Software Assurance, subscription licences (including CSP) or SPLA are required.
• Rules: under Volume Licensing, you cannot buy year 2 or year 3 without the previous years. If you enrol in Azure Arc late, the months you missed are billed retroactively.

At the time of writing, the year-by-year dates, prices and terms specific to Windows Server 2016 are not yet on Microsoft's lifecycle page or in the ESU FAQ. Confirm them with Microsoft or your licensing partner. Microsoft's .NET support policy includes no paid extension for .NET 8. PHP 8.2 will receive no security fixes from php.net after 31 December. php.net notes that some Linux distributions and LTS providers offer backported fixes for unsupported branches. If you choose this route, get the scope and duration confirmed by your provider in writing.

Our rule is simple: tie ESU to a migration date. "One year of ESU, then migration on a set date" is a plan. ESU without a date is a modernization bill that has only been postponed.

A 90-day legacy system modernization roadmap for the 2027 IT budget

1. November 2026: Complete the inventory. Move .NET 8 and 9 applications to .NET 10; among those that will not be ready by 10 November, put the internet-facing ones first. Rehearse the PostgreSQL 14 upgrade on a copy.
2. December 2026: Upgrade PHP 8.2 applications to 8.4 (or temporarily to 8.3 if your dependencies are not ready), and put the Laravel 13 migration on the calendar. Make the decision for Windows Server 2016: Windows Server 2025, a move to the cloud, or ESU with a migration on a fixed date.
3. January 2027: Before 12 January, carry out the decision or enrol in ESU. For SQL Server 2014 and 2016, plan a migration window with the target version your ERP vendor has approved.
4. The rest of 2027: Laravel 12 in Q1; Visual Studio 2017, Node.js 22 and Ubuntu 22.04 in Q2; the SQL Server 2014 ESU in Q3; Python 3.11, SQL Server 2017, PostgreSQL 15 and PHP 8.3 in Q4.

Budget lines: inventory and consulting; test automation and a CI/CD pipeline; licences (including ESU if needed); duplicate infrastructure during the parallel-running period; backup and disaster recovery, including restore tests.

How does Partnerfy approach legacy system modernization?

We run modernization not as one big project but as a series of decisions, made system by system. We start with an inventory and risk scoring based on the list in this article. For each system, we then present our recommended path in writing, with the reasons and the risks. In delivery, we first set up automated regression tests and a CI/CD pipeline. Before each migration, we take a backup and rehearse the rollback steps, and we go live in stages. You can find the full scope on our software modernization page. To arrange an inventory call, contact us.

Sources

• PHP: Supported Versions, Unsupported Branches, 2026 news archive
• .NET: Support Policy, STS announcement, .NET Framework, .NET Framework FAQ
• Windows Server: 2016, 2012, 2012 R2, 2022, 2025, blog announcement
• Lifecycle and ESU: Fixed Lifecycle Policy, ESU page, ESU FAQ
• SQL Server: 2014, 2016, 2017, 2022, 2025
• Other: Office 2021, Office LTSC 2021, Exchange 2016, Exchange 2019, SharePoint 2016, SharePoint 2019, Visual Studio 2017, Windows 10, Microsoft 365 Apps
• Databases: MySQL 8.0, MySQL LTS, MariaDB, PostgreSQL
• Runtimes: Node.js, Python, Laravel, Ubuntu
• Hosting: cPanel MultiPHP Manager, CloudLinux PHP Selector
• Patterns: Martin Fowler – Strangler Fig, Microsoft – Strangler Fig pattern
• KVKK: Law No. 6698 on the Protection of Personal Data (in Turkish), Personal Data Security Guide (in Turkish)

Frequently Asked Questions (FAQ)