They critique a common implementation of hash_equals, which I think we use, showing that you need to use mb_strlen.

Or don't use mbstring.func_overload = 2. Do we support that configuration?

Installer should stop people, but they could enable it after the fact:

protected function envCheckMbstring() {
        if ( wfIniGetBool( 'mbstring.func_overload' ) ) {
                $this->showError( 'config-mbstring' );

                return false;
        }

        return true;
}

They make vague allegations against php-gpg. We should look into those with @Tgr.

That seems to be about php-gpg (a pure-PHP reimplementation of GPG, down to crypto primitives), not gnupg (which is a frontend for the gpg binary). Also, the two MediaWiki extensions that AFAIK use GPG (SecurePoll and GPGMail) call the binary directly (although I want to add gnupg support to GPGMail eventually).

In T122807#1914677, @Bawolff wrote:

Installer should stop people, but they could enable it after the fact:

protected function envCheckMbstring() {
        if ( wfIniGetBool( 'mbstring.func_overload' ) ) {
                $this->showError( 'config-mbstring' );

                return false;
        }

        return true;
}

So,

this should have been removed from /srv/patches?

In T122807#2100642, @mmodell wrote:

this should have been removed from /srv/patches?

No, it should still be applied until 1.26.3 is released.