[cd34]

As far as php, 4.4.4 fixes some rather interesting security bugs that can be remotely exploited in 4.3.10 (and newer) I don't remember if any are privilege escalation capable, but, are more denial of service/interruption of service bugs.

As for mysql, many machines are still running mysql 3.23 as it was one of the most compatible releases they've had. 4.0 & 4.1 have had their share of bugs, and until about 5.0.24, 5.0 wasn't really all that stable. 5.0 gets much more strict with SQL and does break a number of scripts.

As for php, it should be upgraded. I don't think there were any issues dealing with compatibility from 4.3 to 4.4. If you run Zend, I believe there was an api change from 4.3 to 4.4 which will require a new version of the encoder. There are issues with php4 -> php5.

For mysql, tread carefully there. Older versions of VB do not work well with mysql4/mysql5. Even the newer versions have a few issues. mysql5 breaks a lot of scripts due to the stricter sql including some 3.6 releases of VB, some of the early 2.0's of phpbb and many other general purpose scripts.

Just as an interesting side note, mysql 4.1 hit EOL on Dec 31, 2006.

The task of running managed machines really does fall into difficult times because you have to balance stability with security and breakage in scripts that may or may not be immediately visible. while the upgrade itself is relatively painless, staging things, testing applications to make sure they don't break, and having a rollback strategy is complex when spread across a few hundred/thousand machines running diverse software.

Have a list of your scripts that use mysql, get all of the software vendor's contact information in one place, contact them to make sure the script version you are running will work in mysql5, upgrade any that will break, have your host upgrade you to mysql 5.0.30 (or 32) and then fix anything that is broken. Unless you have a real need, I wouldn't suggest migrating to php5.