Don't worry about the possible "passive aggressive" interpretation. You are doing the best that can be done in your position. If they don't see it... well, that's their problem, not yours. You are already being more than enough accommodating by just accepting to work on such a mess of a project!
You did indeed have a more professional set of folks developing that.
I just inherited a small PHP project written 2 years ago:
* no version control * running as root on apache 2.2 in /var/www/html * php 5.5 * about 12 "pages" each with a healthy mix of html/php ('header/footer' are abstracted to external incudes)
the problem with the 12 "pages" is there's around more than double the logic states and I need to add more. there's a bunch of
if($_SESSION['step3done'] && $_SESSION['step3errors']!="") {}
interspersed all over the place. Do I continue the pattern? Or refactor? The previous developer would add 'new' stuff in a matter of a few hours, because they'd just expand on that pattern; it's now unwieldy, and I need to add 'new' stuff, and expectations are "a few hours".
FWIW, it's probably what I'll do, but am migrating code in to version control, adding items in an issue tracker, and documenting my concerns in tickets, a README, and some code comments. It may come across as a bit passive-agressive, but it's not meant to; just trying to keep a history of concerns while also hitting their short deadline.
PHP needs to be upgraded regardless.