IF YOU'RE USING EOL OPEN SOURCE SOFTWARE (AND YOU PROBABLY ARE), YOU MAY BE PUTTING YOUR COMPLIANCE AT RISK

Summary from the TLDR InfoSec newsletter

For example your scanner flags a critical CVE in AngularJS. But no patch exists. None ever will. 🔍 For security teams, we mapped all 20 standards [5] against how EOL components impact each control. 📋 Why PCI's 30-day patch clock is unmeetable on EOL software, and the three statuses every component needs before an audit. 🛡️ How vendor-backed patching satisfies "maintained" under NIST