Our hosting provider wants to update our legacy application server (Plesk).
We usually place older PHP projects (PHP 5.3 - 5.6) there, so they can sit in a stable environment until their unknown EOL.
Now the thing is, our provider wants to remove these old PHP versions for "security reasons". But I'm failing to see, how the removal of available PHP versions increases security (in real life scenarios).
I understand that changing the project codebase may increase security or that a newer PHP version might fix OS (environment) related security issues, but I can't see any attack vector from HTTP to the underlying PHP interpreter.
So, can we say it is "fairly safe" to run an outdated PHP version in an otherwise updated server?