security updates reported but not actually available (recommended==installed)

There are security updates available for one or more of your modules or themes isn't the more appropriate message that is correct in every case. It assumes that, once a release has been marked as insecure, a new release is created, but that doesn't always happen, for example because the project owner or one of the maintainers failed to fix the security issue.

In the specific case:

• All the releases for the PHP module has been marked insecure; this means you cannot install a release that isn't marked insecure
• The 8.x-1.5 release for the Remote Stream Wrapper module has been marked insecure; there aren't more recent releases and the project has been marked unsupported

Implementing hook_update_status_alter() in a module, you can set those modules as ignored.

use Drupal\update\UpdateFetcherInterface;

function mymodule_update_status_alter(&$projects) {
  if (isset($projects['php'])) {
    $projects['php']['status'] = UpdateFetcherInterface::UNKNOWN;
    $projects['php']['reason'] = t('MyModule prevents Drupal from receiving information about module updates .');
  }
  if (isset($projects['remote_stream_wrapper'])) {
    $projects['remote_stream_wrapper']['status'] = UpdateFetcherInterface::UNKNOWN;
    $projects['php']['reason'] = t('MyModule prevents Drupal from receiving information about module updates .');
  }
}