All the info I can find says that Rails team will stop releasing even security patches for Rails 2.3 as of Rails 4 release.

Do you have different info, am I wrong? I guess it's semantics on what "deprecated" means, but I'd be personally nervous using a product that is not even having security patches released by any maintainers.