CVE-2026-54736: Zephir Hash Timing Attackcve-2026-54736-zephir-hash-timing-attack
Comparing cryptographic hashes using non-constant-time functions (`ZEPHIR_IS_IDENTICAL`) makes the application vulnerable to timing attacks. An attacker may use observable timing discrepancies to forge valid MACs or signatures byte-by-byte. Use a constant-time comparison function such as `zephir_hash_equals`.
