InfoSecBulletin Cybersecurity for mankind
Organizations are reminded that three Windows versions released in 2016 are about to lose support. After the last monthly security update, they won’t receive security patches, bug fixes, non-security updates, support, or updated documentation anymore.
End Support for Legacy Windows Versions:
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
Palo Alto PAN-OS Flaw Enables Root Arbitrary Code Execution
Critical Check Point VPN flaws allow remote code execution attacks
Cisco confirms CVE-2026-20079 flaw in Secure FMC is exploited in attacks
Hackers exploit PaperCut flaws using hundreds of AI agents, compromising 440 servers globally
CISA Says Chinese Firms Extracted Billions of Tokens From Frontier AI Models
Nightmare Eclipse Drops New Microsoft Defender ‘ShieldCrash’ zero-day
cPanel Flaw Lets Hosting Accounts With Mail Privileges Execute Code as Root
For defenders, the key issue is the accumulation of risk after patching ends. Systems on outdated versions after the final Patch Tuesday will become non-compliant and more vulnerable to attacks as new security flaws emerge.
Microsoft notes that “LTSB” is the older name for today’s “LTSC” channel, designed for special-purpose devices; the naming shows up differently across documentation, but the lifecycle dates are what matter.
Microsoft advises upgrading instead of relying on extended coverage as a long-term solution. For servers, the recommended upgrade is to Windows Server 2025.
If timelines do not allow a full migration, Microsoft points to the Extended Security Updates (ESU) program as a temporary bridge for up to three years after the end-of-support date.
ESU provides only “critical” and “important” security updates (per Microsoft’s severity ratings) and offers limited technical support focused on ESU activation, update installation, and issues caused by updates.
ESU does not include new features, quality upgrades, design changes, or complete product support restoration. Microsoft will offer ESU for Windows 10 Enterprise 2016 LTSB through Volume Licensing or a Cloud Solution Provider in Q2 2026.
Priced at USD per device for the first year, with a discounted rate for systems managed by Intune or Windows Autopatch.
Microsoft warned that ESU pricing doubles every year for up to three years and accumulates, so enrolling in the second year requires payment for the first year as well. ESU for Windows 10 IoT Enterprise 2016 LTSB is available only through IoT OEMs.
