511,000+ End-of-Life Microsoft IIS Instances Exposed Online, Secure Now!

On March 23, 2026 Shadowserver reported more than 511,000 internet-connected End-of-Life Microsoft IIS instances (over 227,000 beyond ESU) — largely concentrated in China and the United States — creating a large-scale, high-risk attack surface that could be scanned and exploited by threat actors (including ransomware groups and APTs); the report urges organizations to audit external assets, upgrade or enroll in ESU, and isolate legacy systems behind WAFs and access controls.