Technically the OS has been EOL and not supported for a while now per the calendar linked from this previous forum topic FreePBX Versions but publishing mitigation ideas and specific FreePBX module updates that lock down Apache’s use of PHP would fall under the SFCIO category.