PHP 7’s mt_rand leaks its process ID via predictable seed
By dissecting PHP 7.0’s seed generation for mt_rand, researchers show the PID is baked into the seed along with time and LCG state. If an attacker can guess the call time, they can recover the process ID from a single random output, exposing a new side‑channel in many PHP apps.