Where I work the sysadmins decided to upgrade the server, they upgraded the machine, changed the os and upgraded php from 5.3 to… php 5.3. When I protested telling them that it would be better and more secure to upgrade to at least 5.4 at the time, they told me that the new os would be RedHat and that they do backports of security fixes from the later versions of PHP. I’m not sure of how secure this aproach is, but the thing is that in many palces people won’t upgrade because of the support (backports of fixes) that os vendors offer.