At the time we were reluctant to update even our linux servers. We had only critical security fix repos enabled and checked them once a week.

No, we didn't update PHP unless strictly needed.