Surprise, surprise, Sony's servers were up to date. On top of that, the idiot "Security Expert" who testified otherwise had no direct knowledge of anything he reported to Congress, he was just regurgitating rumors like a common internet follower:
As it turns out, it is fairly simple to use Google's webcache to show what version of Apache the PSN servers were using back in March. According to a page request archived by Google on March 23, 2011, at that time Sony was running version 2.2.17 of the software. You can see from Apache's website that 2.2.17 is the latest stable version of the webserver available even today. This is a direct repudiation of the claims being made that Sony's webservers were out of date by as much as five years.
Poster deathindustrial also goes on to point out the folly in using "security expert" Dr. Eugene Spafford's testimony before Congress as a source for the claims that the servers were outdated and that Sony knew about it. In the written statement which accompanied his testimony, Spafford clearly states:
I have no information about what protections they had in place, although some news reports indicate that Sony was running software that was badly out of date and had been warned about that risk.
So he had no first-hand knowledge of the state of Sony's servers or Sony's knowledge about possible exploits, and he was literally repeating claims that he read in the media, which might have stemmed from IRC chat logs that were being passed around back in February. He didn't even do the very basic detective work it would've taken to completely repudiates the claims.
It's sad to say, but many are so eager to see Sony's eye blackened that they are willing to believe any rumor that puts the PlayStation in a negative light. We are in a backwards world where everything Sony says is assumed to be a lie or conspiracy, and anonymous IRC chat logs of dubious origins have miraculously become the most trusted news source in the industry. Here we have a concrete example of why it's important to actually verify your source before repeating something as fact.