Support window remaining: 90 days (Source: Microsoft, via BleepingComputer (July 15, 2026))
A Countdown Measured in Days, Not Years
Microsoft's disclosure this week sets a fixed point: systems running Windows 11 24H2 Home and Pro editions, along with Windows 10 Enterprise LTSB 2016, stop receiving security updates in 90 days. For budget-signers, that number is the entire story — not the operating system's age, not its install base, just the number of days until patch delivery ends and every subsequent vulnerability discovered against it goes unaddressed by the vendor.
The Same Clock, A Different Layer of the Stack
WebPulse doesn't detect operating systems — it detects web frameworks. But the mechanic Microsoft just triggered is one WebPulse's threat feed tracks constantly at a different layer of the same infrastructure stack. CISA's Known Exploited Vulnerabilities catalog, which now holds more than 1,300 entries, is a running record of what happens once support boundaries are crossed or patches go unapplied: the software keeps running and the exposure keeps accruing. Under Binding Operational Directive 26-04, federal civilian agencies face risk-tiered remediation deadlines of 3 to 60 days depending on severity. Everyone else operates without a binding timeline — just the same accumulating risk.
What Happens While the Clock Runs
Support-window expiration doesn't create a vulnerability — it removes the mechanism for fixing one. The pool of vulnerabilities already scored as high-probability exploitation targets is not small. As of this month, 100 CVEs across all tracked software carry an EPSS score above 0.5, meaning modeled exploitation probability exceeds 50% in the near term. Every one of those, if it lands on a system past its support date, has no vendor patch path back to safety — only compensating controls, isolation, or migration. That's the same arithmetic whether the software in question is a desktop OS edition, or a web framework nearing its own end-of-life release.
The Vantage Point WebPulse Actually Has
This is the layer WebPulse does measure directly: which frameworks are running, which versions, and which of those versions sit inside or outside active support. Across the 466,000+ site instances WebPulse has fingerprinted spanning 30 frameworks and 100+ TLDs, support-lifecycle expiration is a recurring calendar entry, not a one-time event — it shows up release cycle after release cycle, on infrastructure that, unlike a Windows desktop, is usually internet-facing by default.
The Executive Calculus
None of this is a prediction about what will be exploited next. It's a description of how support clocks work, illustrated by two concrete instances running in parallel this month: a consumer OS edition and a hosting control panel, both counted down by their vendors on fixed schedules that don't bend to an organization's migration budget. For teams weighing whether to renew, patch, or migrate — on an OS, a hosting panel, or a web framework — the relevant number isn't sentiment about the software. It's the date on the calendar when the vendor stops answering.
