The fact that you’d rather replace software your customers are used to than update to a recent version of PHP speaks boatloads about the quality of your service.
Point of order: the statement “PHP 5.6 is the only version still getting security updates” is technically not correct. PHP 5.3 and 5.4 are still receiving backported security updates from Red Hat (and thus CentOS, Scientific, etc.) until November 2020 and June 2024, respectively.
“Not supported by the original author” is not the same as “not supported”; such is the beauty of open source software.