According to the PHP release chart (https://secure.php.net/supported-versions.php), various versions of PHP 5 will see their security fixes end between 2016 and 2019. Since Ubuntu LTS releases are supported for 5 years, what will happen if they include a PHP version that has no support towards the end of that time?
Ubuntu will backport security fixes into their packages during the support cycle of the package. This support cycle is independent of the support cycle of the upstream vendor (the PHP project in this case).
Note that only packages in the
main repositories of an LTS version of Ubuntu will get the full five year support. Packages in other repos, like
universe might be suported only for 9 months or even be entirely unsupported.