Running Drupal 6 with PHP 5.3 and Maintaining Security I have a number of Drupal 6 sites that I can't upgrade at this time due to sheer lack of time to do so (it would be a major overhaul). Therefore, I am required to continue running PHP 5.3 on my server, but it is already EOL, and there are security fixes that have not been applied to it.

Are there other people here that are using Drupal 6 and PHP 5.3, while keeping their PHP secure? If so, how are they doing it? Is there a source for PHP 5.3 with backported security fixes, like an LTS version? I've seen Zend's version of that, but can't afford it. I saw Red Hat has RPMs with some security fixes backported into PHP 5.3, but not the most recent ones, at least as far as I can tell.
Here are the patches I'm using for D6. Some of these issues will have been committed, thus they don't need a patch anymore.

Views
http://drupal.org/node/853864#comment-6465560 - views_get_default_view() - race conditions and memory usage
http://drupal.org/node/402944#comment-4650020 - Persistent caching for unpack_options() calls from building displays
http://drupal.org/node/1372388#comment-5370432 - Inline/Remove recursion in views_object->unpack_options to improve performance
http://drupal.org/node/465332#comment-4756670 - Strict warning: non-static method should not be called statically
http://drupal.org/node/893128#comment-4894754 - Strict warning: Declaration of * should be compatible with that of views_handler::*
http://drupal.org/node/1265138#comment-4928988 - Notice: Undefined variable: teaser in views_plugin_row_node_rss->render()
http://drupal.org/node/1432242#comment-5807802 - Notice: Undefined index: size in views_db_object->export_row()  

Views Bonus Pack
http://drupal.org/node/1223910#comment-4756506 - Strict warning: is_a(): Deprecated

Views Bulk Operations
http://drupal.org/node/1782662#comment-6469236 - Notice: Undefined index: HTTP_USER_AGENT in views_bulk_operations_form()

Views Datasource
http://drupal.org/node/1265190#comment-4929150 - Notice: Undefined property: stdClass::$name in views_plugin_style_xml->option_definition()

Views Slideshow JCarousel
http://drupal.org/node/1885586#comment-6926004 - php notices



Here are some of the more popular modules as well

Calendar
http://drupal.org/node/999514#comment-4761150 - Strict warning errors for views plugins

CCK
http://drupal.org/node/1118792#comment-4358322 - array_keys() expects parameter 1 to be array, null given in content_multigroup.node_form.inc
http://drupal.org/node/1244534#comment-4845816 - Notice: Undefined index
http://drupal.org/node/1247732#comment-4857954 - Undefined index: _remove
http://drupal.org/node/1156096#comment-4868230 - Notice: Undefined index: title/description in content_storage()
http://drupal.org/node/1251146#comment-4871780 - Notice: Undefined index: #children in template_preprocess_content_field()
http://drupal.org/node/1251160#comment-4871816 - Notice: Undefined index: #field_info in fieldgroup_form_alter()
http://drupal.org/node/1265080#comment-4928778 - Notice: Undefined property: stdClass::$broken in content_handler_field->render()
http://drupal.org/node/1316510 - fix undefined index '#id' notice in form_alter hooks
http://drupal.org/node/533610#comment-5157454 - Notice: Undefined index: safe in theme_text_formatter_default()
http://drupal.org/node/1762506#comment-6411880 - Notice: Undefined property: stdClass::$field_* in content_rules_field_has_value()  

CTools
http://drupal.org/node/1226098#comment-4765262 - Strict warning: Only variables should be passed by reference
http://drupal.org/node/1334894#comment-5215962 - Warning: Invalid argument supplied for foreach() in views_content_views_content_type_render()
http://drupal.org/node/1510118#comment-5807950 - Strict warning: Creating default object from empty value in views_content_views_content_type_admin_info()  

Context
http://drupal.org/node/866208#comment-4845268 - Notice: Undefined property: stdClass::$taxonomy in context_node_condition() on line 352  

Date
http://drupal.org/node/802722 - Extra comma in output when using "display from and to dates" on Display fields configuration
http://drupal.org/node/1223956#comment-4756746 - Strict warning: Creating default object from empty value in date_handler_fields
http://drupal.org/node/1948238#comment-7200236 - Strict warning: Declaration of date_handler_field_multiple::pre_render()   

Features
http://drupal.org/node/1516900#comment-5833834 - Notice: Undefined index: group in views_handler_dependencies()
http://drupal.org/node/1515878#comment-5833794 - Strict warning: Only variables should be passed by reference in content_features_rebuild()   

FileField
http://drupal.org/node/1180508#comment-4872304 - Warning: array_merge() Argument #2 is not an array in filefield_widget()
http://drupal.org/node/1164892#comment-4500360 - Warning: Trying to get property of non-object in filefield_field_sanitize()
http://drupal.org/node/1317424#comment-5146998 - Notice: Undefined index: fid in filefield_widget_process
http://drupal.org/node/1415840#comment-5514392 - Fatal error: Cannot unset string offsets
http://drupal.org/node/1677208#comment-6213652 - Notice: Undefined index: data in theme_filefield_widget_preview
http://drupal.org/node/1775708#comment-6440138 - Notice: unserialize(): Error at offset 0 of 1 bytes in filefield_get_node_files()  

ImageAPI
http://drupal.org/node/1189884#comment-4608576 - Allow for custom code to be inserted into the convert command before it is ran
http://drupal.org/node/1201914#comment-4663120 - Add in the ability to "nice" the convert process
http://drupal.org/node/1250348#comment-4868656 - Fix divide by zero errors.
http://drupal.org/node/1766064#comment-6434498 - User error: ImageMagick reported error code 1. Message: convert: no encode delegate for this image format   

Imagecache
http://drupal.org/node/1243258#comment-4841244 - use lock.inc instead of a file lock
http://drupal.org/node/1761108#comment-6407780 - Notice: Undefined index: filepath in theme_imagecache_formatter_default()  

jQuery Update
http://drupal.org/node/1067290#comment-6516884 - Fix jQuery 1.7 for Drupal 6  

Rules
http://drupal.org/node/1250384#comment-4868884 - Strict warning: Only variables should be passed by reference in rules_core_action_execute()   



Core patches
http://drupal.org/node/496184#comment-5787602 - db_set_active errors out if db_connect fails. Add in the ability to handle this gracefully (don't always call _db_error_page)
http://drupal.org/node/764726#comment-5787642 - (Shared taxonomy patch) hook_taxonomy_term_presave() is missing
http://drupal.org/node/905156#comment-5791724 - PHP notice in form_builder function
http://drupal.org/node/1006938#comment-4661790 - Remove PHP warnings from legacy PHP4 XML parser for new update status release history XML
http://drupal.org/node/352180#comment-2562140 - Better, multi-site friendly "www." addition/removal in .htaccess
http://drupal.org/node/939810#comment-5791876 - Notice: Undefined index: key in format_xml_elements()
http://drupal.org/node/985814#comment-5791916 - Undefined index: configurable in actions_synchronize()
http://drupal.org/node/557542#comment-4989990 - Cache module_implements()
http://drupal.org/node/1317236#comment-5146174 - Race condition in file_delete: Warning: unlink() No such file or directory in file_delete()
http://drupal.org/node/1004820#comment-5171678 - Notice: Undefined index: type in dblog_build_filter_query()
http://drupal.org/node/1345204#comment-5259212 - Optimize element_children()
http://drupal.org/node/753064#comment-5274348 - _menu_link_translate() might avoid calling _menu_load_objects()
http://drupal.org/node/261148#comment-5798704 - menu_masks variable is empty (race condition)
http://drupal.org/node/1688282#comment-6240944 - Unknown error: Function split() is deprecated in _filter_autop()
http://drupal.org/node/521838#comment-6375266 - Clean up drupal_get_schema_versions()
http://drupal.org/node/1710656#comment-6474030 - If item is hidden in _menu_tree_check_access() skip it right away.
http://drupal.org/node/1882556#comment-6913038 - Notice: Undefined index: REMOTE_ADDR in includes/bootstrap.inc on line 2835
https://www.drupal.org/node/2292125#comment-8912499 - PHP 5.5 - preg_replace(): The /e modifier is deprecated, use preg_replace_callback instead in decode_entities() (line 349 of includes/unicode.inc)  



Most of the issues I'm following that have the word notice in it
https://www.drupal.org/project/issues/search?text=notice&amp;projects=&amp;project_issue_followers=mikeytown2&amp;status[0]=Open&amp;categories[0]=1&amp;issue_tags_op=%3D&amp;assigned=&amp;submitted=&amp;issue_tags=&amp;&amp;order=field_issue_version&amp;sort=asc

And the ones that contain the word warning
https://www.drupal.org/project/issues/search?text=warning&amp;projects=&amp;project_issue_followers=mikeytown2&amp;status[0]=Open&amp;categories[0]=1&amp;issue_tags_op=%3D&amp;assigned=&amp;submitted=&amp;issue_tags=&amp;&amp;order=field_issue_version&amp;sort=asc



Query used to find the worst offenders for php issues: http://groups.drupal.org/node/170339