Actually, this company has their own internal development team that doesn't use PHP. They also employ full-time sysadmins. The only reason they used PHP is because they wanted to use a very well known CMS. We were explicitly told to conform to their server specs with our vagrant box to ensure compatibility, etc. So PHP was adopted to support the CMS, and I guess their sysadmin never bothered to upgrade the server.

I wouldn't the cause of this unpatched server to inattention. More like bureaucracy and a bad case of "too many cooks in the kitchen".