After EOL, the original project or vendor generally stops supplying normal security fixes and maintenance updates for that release. New vulnerabilities may remain unresolved, even if the software keeps running and existing applications still work.
Support status has layers. An upstream PHP branch can reach EOL while a Linux distributor or specialist provider continues maintaining its own older package through backports. That separate coverage must be confirmed rather than assumed.
Running an EOL version without any security-maintenance source increases risk, particularly for internet-facing services. A compatibility problem can make upgrading difficult, but difficulty does not restore security support.
Check the relevant upstream lifecycle and your package vendor's policy, identify systems without a maintained fix path and prioritize migration. If you must keep an old release temporarily, restrict exposure and document the remaining risk.