Great news guys! The awesome people @ the Sury php mirror have backported the patch all the way back to 5.6!
Commit
e4745a4
... thus justifying everyone's decision to not bother upgrading: "meh, if it's serious enough, they'll backport a patch for us" 🙄
commit e4745a4