title: How is PHP's mt_rand seeded?
body: <p>I know PHP's <code>mt_rand()</code> should not be used for security purposes as its results are not cryptographically strong. Yet a lot of PHP code does just that, or uses it as a fallback if better sources of randomness are not available. </p>
  
  <p>So how bad is it? What sources of randomness does <code>mt_rand</code> use for seeding? And are there other security problems with <code>mt_rand</code> for cryptographic applications? </p>