Comment 1 for bug 708174

The reason number one is that's against general policy to upgrade versions in stable releases. (That's same for Ubuntu, Debian and number of other distributions).

The reason number two is that the minor releases of php doesn't only include security fixes (check the upstream changelog or even svn log), but also new features, and while it got better in latter years it's still not feasible to just pull new upstream releases into stable releases. The new php version may require new version of some library, etc. and vice versa some somftware depending on php could stop working on newer php versions. It's not that uncommon (check mediawiki f.e.)