Php is still under active development, and has seen a lot of architectural changes at the language level over the last decade that have seen real benefits.

Now, imho, it still isn't a good language, but I wouldn't call it "old". It's not COBOL or FORTRAN where the people who wrote a lot of the mission-critical stuff that banks, research labs, hospitals, and government rely on died 20+ years ago.

A lot of it not receiving investment doesn't come at the language project level, but the individual project level. Accounting likes to pretend that the maintenance portion of the SDLC doesn't exist past a certain point because "what about the shareholders!?" and there are, to date, very few incentives for them to look at the problem in any other way. Let's say you run a Php application that's got Php2Shell vulns and you want to patch it but the only way to do that is to shift major versions, meaning a rewrite of some or all of the code. The code "works fine" according to the bean counters, and there's nothing saying they'll get fined or jailed if a breach occurs as a result, so your project doesn't get funded.