In March 2017, a fatal security hole in IIS 6 was found. Based on the news from https://www.theregister.co.uk/2017/03/31/microsoft_wont_patch_server_2003/, Microsoft has officially announced that they won't patch the security hole and recommended us to upgrate to new Windows Server immediately which has the new IIS version. But the problem is, not all people can upgrade their machines in instance.