Debian Stable has 5.6.9 at the moment, https://packages.debian.org/jessie/php5 - and shipped with 5.6.7 initially.

Security updates for php5 in Debian seem to have changed from backporting security fixes to staying up to date on any given upstream minor branch, including other fixes. https://security-tracker.debian.org/tracker/source-package/p...