Support

PHP 5.3.10 was made End Of Life by its developers on August 2014. This means that the people developing PHP do not provide any security patches for PHP, therefore there is nothing for Ubuntu to include in later versions. Also note that unoffocial backported security patches are

a. not always possible, leading to vulnerabilities left behind in your version of PHP; and

b. might introduce subtle bugs as they have not gone through the same development, vetting, testing and auditing process that regular PHP patches go through.

As a result what you will end up with is NOT PHP 5.3.10, it's a different language executable which cannot be possibly supported. Furthermore, what you end up with is still insecure, outdated and obsolete.

Finally, do note that we still offer security updates for our older versions. We only get an average of one security incident every 2.5 years, that's why you might have not noticed. Last August we did provide security updates even to our Joomla! 1.5 software which was EOL for nearly two years at the time. Again, as I have explicitly stated in the article regarding PHP 5.3 support, you can STILL use our OLD and UNSUPPORTED versions which receive security updates on an as-needed basis.

e CANNOT and WILL NOT guarantee that we can provide such updates for eternity because the requirement to providing any kind of update is being able to test it. For the reasons I painstakingly explained in the article we might NOT be able to test updates against PHP 5.3 in the not-so-distant future. I do think that until 2017 we will still be able to test against PHP 5.3 using obsolete versions of our test servers' virtual machines. Beyond that point things get really, really hairy. For example, I can no longer use the virtual machine which hosted our Windows XP / PHP 5.2 / Joomla! 1.5 testing environment. This means that I can no longer provide updates to our Joomla! 1.5 software since its second most popular environment is now untestable.

In theory I could keep an army of old computers at hand, each one running various degrees of outdated software. But this has a huge cost for hardware, setting up new machines, space occupied (floor space of the cool, dry, free of moisture kind does cost), regularly testing to see if they still fire up etc. If that brought in money I'd be willing to do that. But since it's something which bleeds money I'd rather stop supporting PHP 5.3 sometime in the not-so-distant future.

So, for Pete's sake, upgrade your servers sometime in the next 12 months. You don't HAVE to use a pre-packaged version of extremely outdated PHP. Compiling it yourself is trivial. What's more, you can have multiple PHP versions run side by side. Your self-compiled versions will be up-to-date and more secure, the built-in, pre-packaged PHP 5.3.10-patchwork-of-hacks version will be severely outdated and insecure. I really don't see what's the big deal. In the time it took me to write this reply you could have compiled FOUR versions of PHP and set them up, simply by using the PHP builder script in the Vagrant box I linked to from my article on PHP support!

I've also seen Citroën 2CV on the street. They're still street legal. Does that make them as safe or efficient to drive as a modern car? Same with PHP 5.3 on a live site. It looks good, until you realise that it's slow, inefficient and any crash will be fatal.

This conversation is finished. We are NOT going to test our software against PHP 5.3 starting this June. If it still works, fine. If it doesn't, you have been warned. Please note that you have been warned to upgrade since April 2015.