They might be alluding to some of the specific examples in our blog post. Like, mbstring.func_overload, or chr() being a great way to leak crypto keys via cache

They might be alluding to some of the specific examples in our blog post. Like, mbstring.func_overload, or chr() being a great way to leak crypto keys via cache-timing. These sort of things aren't obvious and can very easily (and justifiably) be blamed on the language itself. A lot of PHP crypto libraries are very cavalier about using functions without understanding their implementation details. https://github.com/devi/Salt/blob/fde775cf52402013efce81275919dcfd9f381fba/FieldElement.php#L19 https://github.com/devi/Salt/blob/fde775cf52402013efce812759... https://github.com/phpseclib/phpseclib/blob/ab1da5ac1f2fa60ba97d6f6f6909b0123704bc36/phpseclib/Crypt/RC4.php#L327 https://github.com/phpseclib/phpseclib/blob/ab1da5ac1f2fa60b... https://github.com/zendframework/zend-crypt/blob/9b7da4a6d4db0bfc5c1cd0910d08b3e4af6d9cc5/src/Symmetric/Padding/Pkcs7.php#L28 https://github.com/zendframework/zend-crypt/blob/9b7da4a6d4d... Fortunately, most cryptography libraries these days just wrap OpenSSL and rarely implement their own ciphers or hash functions.