On January 14, 2020, Windows Server 2008 and Windows Server 2008 R2 will reach their End of Support date. After this date, patches and security updates will no longer be generally available, but there are some alternative options to continue receiving updates.
Migrate to Azure
Migrating Server 2008 and 2008 R2 servers to Azure will entitle those migrated servers to 3 additional years of security updates at no additional cost. This will include all security updates with a critical or important severity rating. This provides a relatively easy way to maintain security updates without having to upgrade affected servers, but no non-security fixes or new features are to be expected during this extended security update phase.
Migrating to Azure is easy with Azure Site Recovery, or ASR for short. ASR will replicate your on-premises VMware, Hyper-V, or physical servers to Azure. Once replicated, you can power them on directly as Azure VMs with minimal downtime during cutover.
On-premise Coverage
If you choose to stay on-premises, Microsoft is offering up to 3 years of extended security updates for a fixed cost. This option requires active Software Assurance or subscription licenses. Choosing this option allows you to keep your workloads running on-premise, and continue getting security updates, for an additional cost.
Upgrade Options
The alternate option is, of course, to upgrade your remaining Windows Server 2008 or 2008 R2 servers to a later version. Windows Server 2016 still has 8 years of support left, and Windows Server 2019 has just under 10 years left.
Although building new servers and migrating workloads is the preferred way to upgrade, you can do in-place upgrades from Server 2008 and 2008 R2 to later versions. See the documentation for supported upgrade paths.
SQL Server 2008
Also included in the above options is SQL Server 2008 and SQL Server 2008 R2. These products reach end of support on July 9, 2019. Migrating to Azure VMs will extend coverage for 3 additional years, while you can purchase coverage for on-premise machines for a cost.
For more information, see the Extended Security Updates FAQ and the official Windows Server 2008 End of Support page