Great news guys! The awesome people @ the Sury php mirror have backported the patch all the way back to 5.6!
commit 948af12
... thus justifying everyone's decision to not bother upgrading: "meh, if it's serious enough, they'll backport a patch for us" 🙄