How dangerous are outdated PHP versions for my clients?

Question

In the company where I work (webhosting) our custoumers can choose the PHP version they want to use for their website.

However, I have just realized that all of the offered PHP versions are outdated (ie. PHP 5.4.38, 5.5.22 and 5.6.6 being offered to our clients - current versions are 5.4.43, 5.5.27 and 5.6.11). How dangerous is that to our customers? Is running those old versions pure madness or is it just a minor risk for our customers?

edit: There are no security updates applied, it is just PHP 5.4.38 from a few months ago.

Answer 1

Most new versions come with security improvements, so the older a version is the more time an attacker has to take advantage of it.

You can browse through a vulnerabilities library, for example here is one for php 5.4. You can check yourself how many vulnerabilities have been disclosed and how severe they are. For the most part I think its a matter of which extensions are enabled and the specific code, I dont remember the CVE identifier but I remember a multibyte function in php (a long time ago) that would cause a buffer overflow if given a specific string.

In my opinion, the versions you currently have are not terribly old, but they do pose some security concerns, here's one example of a DoS vulnerability.

Look at it from another angle, new php versions also come with changes in functions and updating to a newer version may not always be transparent to the application, things may break. So a hosting company should also not automatically update the PHP version without consent from the client.

Answer 2

If security updates are being applied, it's perfectly fine, even normal, to run an older version of PHP.

On a desktop computer, people often approach updates with the mindset of always wanting to get the latest and greatest versions, which is fine (and good) for end-user machines. But for servers, the focus is on stability - people usually don't want to update critical server software to the newest version as soon as it is released; updates can often break things and they want to wait until it is more thoroughly tested before updating, for stability reasons. Thus, it is common practice to only install security updates immediately, and wait a while before upgrading to a newer release.

Answer 3

Is running those old versions pure madness or is it just a minor risk for our customers?

No, not at all: it is neither a pure madness nor a minor risk. You must absolutely find a way to convince (in the case you can not do it by yourself) your clients to upgrade their PHP versions to the newest one IF it is possible OTHERWISE update the security features of their current versions.

PHP versions are there mainly to fix security vulnerabilities of old ones.

You can find thousands of security vulnerabilities of previous PHP versions on CVEDETAILS with full details of their impacts and severity.