A 174-line "temporary" PHP fix lasted 12 years and 20 million installs

A developer just retired a 174-line PHP workaround he wrote in 2014 that quietly accumulated nearly 20 million installs.

Twelve years ago, developer Jake A. Smith wrote a quick polyfill for an old function while upgrading AOL’s content management system. He put it on Packagist in case anyone else needed it. The stopgap grew to pull 400,000 installs a month, got bundled into WordPress plugins like WPML, and landed inside Debian and Ubuntu. Today, Smith officially deprecated the package, choosing to retire it rather than risk handing maintainer access to unvetted volunteers.

Why it matters: Nothing lasts longer in tech than a temporary fix. But modern PHP 8.5 now includes standard URI tools, and handing off control of a widely downloaded package creates severe supply-chain risks—the exact vector seen in the xz Utils backdoor.

If you still rely on the package, the README lists replacement options like the PHP League URI library.

As for AOL’s content system, it ran on the temporary patch until the entire platform shut down in 2020.