If you're using out-of-support version, you should either use a distro that backports patches or contract somebody to do the backports for you. Otherwise you're basically hanging a sign saying "please pwn me" on your site. This is true for any software, not just PHP (for PHP, most security fixes are actually not hard to backport, just somebody has to do it).