PHP branches older than 5.6 left upstream support long before October 2026. The end-of-life table lists PHP 5.5 at 5.5.38 on 21 July 2016, PHP 5.4 at 5.4.45 on 3 September 2015, and PHP 5.3 at 5.3.29 on 14 August 2014. PHP’s PHP2Shell announcement does not add source backports for these branches.
Ubuntu 14.04’s ESM php5 package is a PHP 5.5.9 backport, documented on the PHP 5.5 guide. It is not a generic fix for every pre-5.6 tree.
Our consulting scope is centered on PHP 5.6 and newer because that is where organizations still run business applications they can realistically test. Older trees can be assessed. The honest recommendation is usually to remove them from the internet or to replace the runtime, not to wait for an upstream 5.4 release that will not exist.
Nginx and Apache only route the request. On PHP older than 5.6, identify whether the vhost uses PHP-FPM, mod_php, or CGI. mod_php remains the highest-risk SAPI in PHP’s advisory regardless of how old the branch is. PHP-FPM on older than 5.6 is still in scope for CVE-2026-109619’s session path. Restart the daemon that loaded this branch after any package change. A host with PHP older than 5.6 and a newer PHP side by side is only fixed for the vhost you actually updated.
Questions
Does consulting include PHP 5.3?
A remediation plan can include very old branches. The likely outcome is isolation or a migration, not an upstream patch.