Like the other commenter said, PHO 5.6 to 7 upgrade isn't that hard. If it is, there's a very good chance they are doing something devastatingly wrong (like using mysql_ extension).
Another problem are the Docker images. The PHP project still provides Docker Images for 5.6, however to my knowledge they are not updated anymore (perhaps I'm wrong). So what about all the security vulnerabilities in the underlying linux image? (I just verified and the latest php 5.6 image is from January 2019)
That being said, using a newer underlying Linux image for a Docker image is as copying the Dockerfile and building it, isn't it?
I think the PHP project should simply delete the 5.6 image, since it is insecure and EOL'ed. Then if somebody is interested they can provide an alternative image somewhere...
As are many/most PHP 5.6 projects
> Probably their code should not be used.
In reality it is - unfortunately. And many smaller companies don't have the capacity to change.
I'd be more concerned about having a Magento 1 site in the wild, than the upgrade path to PHP 7.
Where I work I develop a web app that's written in Rails, and it's replacing a legacy PHP 5.6 app. Now here's the thing - no-one is using the PHP app anymore, but we do still have some old data on there that we made a decision not to port over to the new app. At the time it seemed like it wouldn't be a problem - just keep an old version of the app up for those who need to view historical information.
Now I'm thinking I'll have to set aside some time to either port it to PHP 7 (which isn't really a priority) or come up with something else for viewing that historical data.