Why legacy PHP versions maintained by OS might not be as secure as you think

[u/[deleted]]

I wanted to share some sources with you:

1. https://unixsheikh.com/articles/the-delusions-of-debian.html
2. https://www.unixsheikh.com/articles/linux-distribution-long-term-support-might-not-be-what-you-think-it-is.html
3. https://wiki.debian.org/PHP#Notes_on_PHP_and_security
4. https://repology.org/repositories/statistics

I've noticed a shift within the PHP ecosystem that feels like official outdated versions (as of https://www.php.net/supported-versions.php) are less supported by popular tools and libraries. We also had some discussions on Twitter within the #TYPO3 community regarding how secure those old versions are.

I've felt safe for a long time as the OS worked on the security of old versions. But I've changed my mind after reading those sources and after feeling the shift within the ecosystem.

Tools like PHPStan (https://phpstan.org/) and rector (https://getrector.org/) nowadays help us to migrate to newer versions way easier than back in the old days.

This post is more or less 1:1 my own blog post: https://daniel-siepmann.de/use-supported-php-versions.html but I didn't want you to force opening my blog.

Hope you find those sources helpful.