Legacy ciphers such as triple-DES (3DES) and Blowfish are vulnerable to Sweet32 attacks, which let attackers decrypt HTTPS sessions even without the encryption key. Security researchers were able to use a Sweet32 attack and take authentication cookies from HTTPS-protected traffic using triple-DES (3DES) and Blowfish and recover login credentials to be able to access to accounts.
Blowfish and 3DES are still supported in TLS, IPsec, SSH, and other protocols. Enterprises and developers should treat 3DES and Blowfish in the same way they treat RC4: stop using it.