PHP did, it's actually 5.6.8
OpenSSL 1.0.1l would be ok with a tighter SSL config, what I am seeing in the .7z package is actually frightening, but then Xampp is not for production use. I however was unable to find anywhere that clearly states this on the website or the download page.