Drupal 7 went end of life January 5, 2025.

Here is what that looks like on real sites.

Security advisories still get published. Patches do not.
The Drupal security team still documents vulnerabilities in D7 contrib modules. Fixes ship for D10 and D11. D7 gets nothing. The CVE exists. Your site is listed. The fix is not coming.

Hosts are dropping PHP 7.4 support.
D7 runs on PHP 7.4. Most hosts have either deprecated it or moved it to a paid legacy tier. Sites start throwing errors not because of any attack because the server underneath changed.

Contrib modules are going abandoned mid-project.
Maintainers are moving on. A module that worked fine in January stops getting releases. One server update breaks it. Now you are either patching it yourself or ripping it out.

The handoff problem.
If you are a developer maintaining D7 sites for clients - what does that conversation look like? "Your site is technically running but I cannot promise what happens next month" is not a great position to be in.

Anyone still handling D7 client sites? How are you managing it?