End of life means the PHP project will not ship a tag. It does not mean the binary is safe, and it does not mean every vendor ignored it.
For 7.4, 8.0, and 8.1, PHP published minimal source backports. Use them only if you already build PHP. Prefer a distribution package when the distribution lists one, such as Ubuntu 22.04’s php8.1 revision or Ubuntu 20.04’s ESM php7.4.
For 5.6 and for 7.0 through 7.3, there is no such PHP project backport. Some vendors still shipped packages. Ubuntu’s table includes 7.0, 7.2, and a 5.5 ESM package, not a generic 5.6. AlmaLinux patched several retired module streams. If your vendor is silent, do not synthesize a version number.
The remaining controls are migration to a fixed supported release, or isolation from untrusted networks, plus the temporary settings PHP listed. CISA recommended taking unpatchable older PHP offline. That is the strong form of isolation.
Consulting exists for this gap. The deliverable is a chosen path and a test plan, not a certificate that 5.6.40 became secure.