ETC Maryland takes server security seriously.  One way ETC Maryland provides is to make sure the Linux version used are Long Term Support releases.  This maintains the code base at a set level.  This also means a reduced bug count and increased system stability.  Sometimes this means “old” versions of popular software like PHP stays in our systems.  The long term support channel means the distribution takes fixes for newer PHP(and other popular packages) versions and backports them into the “old” versions.  ETC Maryland usually maintains a 1-2 cycle on LTS OS version upgrades.  When a new LTS is released ETC Maryland evaluates system stability with the new release and also works with our vendors on testing and stability.    As I mentioned above the distribution(in my case Ubuntu) makes sure any security issues with things like PHP that are found will get put into the current version of PHP they support…in this case PHP 7.2.x.  As long as the LTS version is supported then the backporting is also continuing.  ETC Maryland will keep our clients notified when a new operating system is being prepared for installation.