CVE-2025-68932: Php Weak Prng Token Hashcve-2025-68932-php-weak-prng-token-hash
Security-sensitive token is derived from a non-cryptographic PRNG (mt_rand() and/or uniqid()) and then hashed (sha1/md5/hash). Mersenne Twister state is recoverable from a small number of outputs, and uniqid() encodes a microsecond timestamp (~20 bits of entropy). Hashing does not add entropy. Use random_bytes() (or random_int()) as the entropy source for au
