That... just makes it so their tech debt turns into entire world's security problems.

5.6 is unsupported. There should be not getting special treatment just because they have massive tech debt

> (It is often much cheaper for an enterprise to just get a long term support contract than to properly upgrade to a modern PHP stack.)

I've experienced similar to this. I know I shouldn't be, but I still get amazed every time I hear that some small company is still using an old DOS machine running core software based on dBase that nobody has any clue on how works and the developer has since moved on to a higher plane. One person told me that they sweat every time the power goes out longer than the attached UPS can run holding their breath that the machine powers back up.