In reply to Eric Johnson.

No official security updates from the PHP group. But in practice, Linux distributions still provide them via back-porting.