Since rMW47241a3520d5b4bf, MediaWiki core by default now uses OpenSSL when available for creating and verifying type "pbkdf2" password hashes. This is more efficient and would allow for a significant increase in the number of PBKDF2 iterations if desired (see T234987). However, the way the core change was implemented means that Wikimedia sites still use PHP's hash extension for this purpose. CommonSettings.php specifies that the class "Pbkdf2Password" be used, and for compatibility reasons, that class name refers to "Pbkdf2PasswordUsingHashExtension" rather than any implementation that uses OpenSSL.
https://gerrit.wikimedia.org/r/c/operations/mediawiki-config/+/842522 would change CommonSettings.php to instead reference the new class "Pbkdf2PasswordUsingOpenSSL". @Urbanecm said on IRC that deployment of this change should be coordinated with SRE. So I am filing this task to request SRE assistance with the deployment.
Note that even if we decide to switch to a different password hashing function such as Argon2id (see T216682), I think this config change should still be deployed in order to verify that the OpenSSL code path works in production, since that is what would be used if the Wikimedia-specific configuration for type "pbkdf2" were to be removed from CommonSettings.php.