Suhosin has yet to release any undates for PHP v5.4.x and v5.5.x. Shared hosts are likely as a result of this, to hang on to 5.3 for the time being. Its a good thing that 2.5.6 and 2.6? will have backward compatibility until PHP and Suhosin come up with one.

A few webmaster forums surprisingly mentioned that PHP 5.3.2 and up actually included Suhosin in the PHP distibutions themselves. Not sure if that included that of the bundled Apache/PHP/MySQL server packages. Any one else hear anything like that?

This article here states it is dead:

http://en.wikipedia.org/wiki/Suhosin

Quote:

And this forum posting says it best:
http://stackoverflow.com/questions/14405053/is-php-5-4-safe-without-suhosin

Quote:

Thanks RHR,
Perfectly logical that PHP should incorporate patch related changes. And like the thread mentioned, new risks are opening as PHP advances, and PHP seems to be accelerating major version releases with reckless abandon (like Firefox, which went from v12 to 23 in what, a little over a year). Moores law in motion?