Weak KDF iterations (ARCH7116)

Key php.security.weak-kdf-iterations · Severity warning · Category security · CWE CWE-916

Using a password key derivation function with too few iterations / too low a cost, or a fast hash, weakens brute-force resistance. A modern, tuned cost factor is required.

Incorrect

<?php
$hash = hash_pbkdf2('sha256', $password, $salt, 1000, 32);
// or a fast hash: md5($password)

Correct

<?php
$hash = password_hash($password, PASSWORD_BCRYPT, ['cost' => 12]);
// or Argon2id:
// $hash = password_hash($password, PASSWORD_ARGON2ID);

Fix

Use password_hash() with bcrypt/Argon2id for passwords and raise the cost/iteration factor in line with current guidance.