I didn't realise they backported security fixes for PHP(as the example) independent of the vendor thanks for that you massively upgraded my knowledge.