SecurityInfo thinks my PHP is vulnerable because it's from Debian Stable

Nobody has claimed this yet.

I'm running PHP `5.6.9-0+deb8u1`, aka PHP 5.6.9 as packaged in Debian Stable ("Jessie", as of this writing). SecurityInfo wants me to update to PHP 5.6.11, but this isn't actually very good advice:
1. If I install PHP from some other source, then I'm installing an untrusted binary on my system. Not only that, but I'm basically giving the distributor root, because `dpkg` will execute package maintainer scripts as root.
2. If I fix the first issue by building PHP from source, then I don't receive automatic security upgrades.
3. If I fix the first issue by installing PHP from Backports, then I don't get support from the Debian security team, and have to rely on the backporter to push out security updates.

There really isn't a good answer. The solution is for SecurityInfo to check against the latest version of PHP available _from Debian_ (on Debian systems, obviously), and ensure that the versions match.

Start by locating the SecurityInfo code that compares the installed PHP version and produces the update recommendation, then inspect how Debian systems and package versions are identified. Done means Debian Stable installations are compared with the latest PHP version available from Debian, so the reported PHP 5.6.9-0+deb8u1 is not incorrectly advised to install PHP 5.6.11.

Written by the indexing model from the issue text.