Ubuntu 14.04 shipped with PHP 5.5 by default, and it's supported until next month. I don't know how well the maintainers backport security fixes from newer vers

Ubuntu 14.04 shipped with PHP 5.5 by default, and it's supported until next month. I don't know how well the maintainers backport security fixes from newer versions, but at least technically it's still supported. The last security update to php5-common on trusty came out only a few days ago. End of upstream support is meaningless in a world where most servers run LTS distros of one flavor or another. I've been telling my clients that they should be able to rely on PHP 7.2 for a long, long time because it's the default version in Ubuntu 18.04 and RHEL/CentOS 8, both of which come with 10 years of support.