How are you scanning to detect the OS version though? And verifying if PHP came from a package or a separate compile? Some hosts deliberately fuzz external indications of the base OS so you'd need an account to log into to properly check this, and they could have a compile from source version of PHP due to install procedures that date back before major updates to the base OS (and were updated "the wrong way"). Your effort is laudable (I'm all for naming and shaming the insecure) but you are open to false positives which could cause you legal issues.