It looks like the author obtained the results using the banners obtained by using a scanning tool. For distributions like Ubuntu LTS or RedHat/CentOS, security fixes are backported to older versions of applications like Apache or PHP. For example RHEL 6 bundles PHP 5.3, but backports relevant security fixes.