Move off end-of-life software
Why it matters
The software versions named in the finding no longer get security fixes from their vendor or from any long-term distribution, so every hole found from now on stays open. Moving to a supported release is the only fix; hiding the version number does not help.
Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.
The fix
- Confirm what really runs. Ask your host or check the server (php -v, nginx -v, apachectl -v, openssl version). If the host says it maintains this release under a paid extended-support programme (Ubuntu Pro, Debian ELTS, RHEL ELS, CloudLinux), get that in writing and plan the move anyway.
- Pick the supported release to move to. For PHP choose a version your CMS, theme and plugins support; for a web server or OpenSSL take the release your operating system ships, which usually means upgrading the operating system itself to a supported version.
- Build the new setup next to the old one (a new server, container or hosting plan, or a staging copy), copy the site over and test it, including forms, logins, checkout and scheduled jobs.
- Switch traffic to the new setup, keep the old one for a quick rollback for a few days, then shut it down. Rescan to confirm the old versions are gone.
Related
Scan your domain to see whether this applies to you.