as Emil Moe mentioned.
php.net/supported-versions.php
basically you don't get any security patches by not switching to php7 and I personally would already switch to php7.1 if you look at the timeline.
Emil Moe well that's classic debian policy, they are very focused on stability. but in theory you could just add "sid" as a mirror or the classic dotdeb packages.