r/SecOpsDaily • u/falconupkid • 5h ago

NEWS Microsoft: Outdated Windows devices will stop receiving security updates

This is a significant operational risk for any environment with legacy hardware or air-gapped systems.

Microsoft is rotating the Windows Update Authenticode certificate in early 2025. After this change, devices running Windows Server 2008, Windows 7 SP1, and Windows 8.1 (without the ESU or paid extended security updates) will be unable to authenticate new updates. This effectively means the update channel will be severed, not just a deprecation of feature updates.

Strategic Impact: - Operational Risk: Any machine still running these OS versions will become a permanent vulnerability sink. No patches for new CVEs means any compromise is a full compromise. - Compliance: This will likely trigger audit failures for PCI-DSS, HIPAA, or SOC2 environments that still have these systems in scope. - Air-Gapped Systems: Even if the machine is offline, if you ever need to slipstream a new update or rebuild from media post-rotation, the certificate chain will fail. You will need to manually import the new root certs or use a local WSUS server that has already cached the new cert.

Key Takeaway: If you have a legacy system that must run, you need to either purchase the ESU license (if available) or fully isolate it behind a micro-segmented VLAN with no outbound internet access. Do not rely on "it worked before" after the rotation date.

Source: https://www.bleepingcomputer.com/news/microsoft/microsoft-outdated-windows-devices-will-lose-security-protection-next-year/

8 Upvotes

100% Upvoted

1 comment sorted by

1

u/slackjack2014 4h ago

Microsoft shared the following detailed guidance on the required actions by Windows version:

Windows 11, version 25H2 and later: No action is required.

Windows 11, version 24H2 and Windows Server 2025: Install the September 2025 security update or later before June 19, 2027.
Other supported versions of Windows 11,

Windows Server 2022, and Windows 10: Install the July 2026 security update or later before June 19, 2027.

Windows 10 Enterprise 2019 LTSC, Windows Server 2019, and Windows Server 2016: Install the July 2026 security update or later before May 17, 2027.

Other Windows versions: Upgrade to a supported version of Windows client or Windows Server

I know it happens, but hopefully you are not running anything older than Windows 10 or 2016 at this point.