A version that has been end-of-lifed and is superseded by three minor releases is a pretty strong indication. The amount of work involved in backporting patches is likely to be significantly more than migrating to a supported version which receives timely patches.

No it's not a strong indication at all. Red Hat does the backporting work for you. You choose that platform if you want your software you spent man-decades writing to keep working for 10-13 years.

It is a strong indication, because we are talking about non-packaged versions. PHP 5.3 is still maintained in Ubuntu, so those hosters aren't on the blame list. Only if PHP 5.3 / 5.2 / 5.1 is used without package manager.

It might be a strong enough indication to investigate further, but it is not a strong enough indication to out a company. You need to actively test the vulnerability to be sure (or relabel your page with a heavy disclaimer).

That is true, there are many manufacturers that keep up to date and add their own patches. Though for a frontpage, I don't think that is true. It is much easier to update your software, than going through all patches, keeping up to date. So for clients I believe you can maintain 5.3, but for just your own frontpage? I doubt it...

Also I would believe that having PHP 5.3 is an unique selling point, so they would advert that unique selling point on their website. (What wasn't done)

> It is much easier to update your software, than going through all patches

If you're on CentOS, as a lot of web hosts are, all you need to do is `yum update` from time to time.

Yes and then you are using a packaged version. But those hosters don't use a packaged version. So yum update doesn't work. I would definitely advice everybody to use a package manager, because that helps you keep everything secure ;)

Because PHP au contrary to Apache returns the full packaged version (so PHP packaged version are easier to check out). Also having e.g. OpenSSH ubuntu version strongly suggest you are using PHP ubuntu version. In that way we could cross out some of the packaged versions.

How do you know that they don't? You state it, but you offer no proof to support that.

The dominant control panel on the web is cPanel, which offers no ability to used packaged versions of PHP, Apache, or any of its extensions. They have a special interface used to pull in everything (sources, and even custom patches from cPanel) and compile it on the server and install it directly (configuring PHP, Apache, and any of the chosen extensions) automatically.