I am talking about the PHP 5.3.3 package that is available in the Red Hat Enterprise Linux repository, running on Apache. From what I can see, as of RHEL 6, it is the latest version (no updates available). I assume security patches are backported, so my question is, with all other things being equal: Is this package less secure than if I had downloaded and compiled the latest stable release from the PHP site?
Please take below-mentioned as my personal opinion.
I think is is less secure. But it depends on what you consider a security problem and what not.
real life example
my company reported a few security issues to PHP. They have fixed it in latest release of 5.5.x ..
I'm not even going to get into they have forgotten to fix it on 5.4.x tree and haven't released an updated version for 5.4.x even after my emails.
The bug report for one of them is here: https://bugs.php.net/bug.php?id=67538
Red Hat bugzilla for it is here: https://bugzilla.redhat.com/show_bug.cgi?id=1120266
Red Hat does not really consider this a security problem even if it affects quite a few shared hosting environments - as they say
disable_functions and similar "protections" (that can be bypassed using above-mentioned bug(s)) are not real protections and should not be taken so.
Having said that - it's only up to you to decide whether it even make sense to somehow assume PHP provides some security features.
In my opinion your environment should be configured in a way that even if someone compromises a site and gains access to PHP they won't be able to do much more than just messing with that one site and nothing else.
One more answer I gave on stackoverflow might become handy in considerations.
edit: none of the issues we've reported to PHP weeks ago have been fixed in RHEL so far - that's what I based my opinion on.