This is going to sound like empty language-war rhetoric, but: PHP might be the worst mainstream language in which to implement crypto. A crappy type system is one thing, but an unpredictable type system is much worse.
I didn't intend to spread FUD when I posted this - I wasn't aware the equality check was also fixed. I use Laravel in a lot of projects and only saw it posted elsewhere today.
Just curious but where did you see this? This was posted last week on /r/php and the Laravel creator stepped in and pointed out that it was patched awhile ago.
I published details of a separate issue on my personal blog (linked in the first paragraph of this article). This is delayed publication of a second set of issues.
All sites were vulnerable to authenticating as other users or tampering with ciphertexts. Error reporting enables the RCE. However, I still hope that nobody is vulnerable or panicking since this was reported and fixed last year.
