The devs were not using DES, per se, they were using crypt() and the default cypher: http://www.php.net/crypt http://www.php.net/crypt At the time they implem

The devs were not using DES, per se, they were using crypt() and the default cypher: http://www.php.net/crypt http://www.php.net/crypt At the time they implemented this (~5 years ago) most PHP tutorials just pointed to either crypt or md5. The other cyphers and functions were either added later, were not in stable PHP branches at the time, and/or most common tutorials had not picked up on them. It is also a pain to port your password storage method