Well you can't really know, if it is outdated or if it has back-ported patches. But chances are that your webhost is telling you the truth, and that it is not outdated from a security perspective. They are probably running Debian.