mcrypt_create_iv uses MCRYPT_DEV_RANDOM as source, not MCRYPT_DEV_URANDOM
But in 369 line https://github.com/yiisoft/yii/pull/2615/files#L1R369 used /dev/urandom.
Should they be equal?