Canonical still maintains it. If you're just hosting some HTML or even PHP, you have a comfortable amount of time before you need to upgrade, assuming you're a paying customer.

I jest, but we had (HAD) an Ubuntu 18.04 LTS that received the backported patch for PHP2Shell, even if the version wasn't supported officially by PHP.

This is why I insist our developers use the Ubuntu repositories instead the official PHP ones: besides possible instability, PHP doesn't do ancient backports.