May i move your comment here, @ekerazha? You've commented this LOC in my fork's repository, moving discussion here would allow everyone participate it:

>Can we find a place for /dev/urandom? It isn't as strong as /dev/random (note: /dev/random can be extremely slow if there's not enough entropy in the entropy pool), but it's probably better than mt_rand(). Maybe we can add it before mt_rand() when $cryptographicallyStrong is false. Opinions?

https://github.com/resurtm/yii/commit/9cd40000d9ca4fae3dfa4dbf4347103bc9c4f841#commitcomment-3568841