
PHP bcrypt still truncates at 72 bytes. The RFC did not ship.
On Ubuntu 24.04 PHP 8.3.6, password_hash still silently hashes the first 72 bytes. The 8.7 deprecation RFC has no yes votes; the author parked it for a gentler PASSWORD_BCRYPT_SHA256 draft. I would not invent E_DEPRECATED on today's CLI, and this is not a Laravel-core CVE.
Oct 9, 2026 · 9 min read