I'm a senior developer maintaining a FinTech SAAS web application. The web application is currently running on Fat Free Framework on PHP 5.4 on a LAMP stack. I've been instructed that it has not been upgraded because upgrading to 5.6 would cause issues with our authentication plugin (BCRYPT).
I am aware that PHP 5.4 reached its EOL on 3 Sep 2015 which included ending security support. Similarly, I am aware that PHP 5.6 will reach its EOL Dec 2018 and will lose its security support as well. We have also recently completed a web application security audit with a 3rd party contractor. Oddly enough this information regarding the PHP versions was not included in the draft report --which I was expecting to see. I intend to bring this up with them following presidents' day.
To be clear. I have raised the 5.6 EOL to my CTO, but have not raised the 5.4 EOL issue yet (more on that later). Originally I was not aware of it until I expressly checked it following its omission in the draft report. I have recommended we upgrade out of PHP 5.x because of the security risk involved; however, my CTO has rejected this thrice: ostensibly because it'd take to long and/or prioritizing new features promised to clients.
I intend to bring this up a 4th and final time, but wish to do so armed with tangible information on the risks involved. The answers to my question below will be included as well as points raised when I discuss this with my security auditor.
So with respect to
risk management what are the distinct risks of continuing to support this application with PHP 5.4 and/or PHP 5.6?
Note: I am well aware that this is a security risk, but I don't know specifically why. I am developer not a security specialist. As such, I would greatly appreciate detailed answers . Inclusion of known unpatched exploits that affect FFF or PHP 5.4 would also be appreciated. If there's a website that supplies such information even better.