A low value target maybe, but having a critical security ticket open for seven years is unforgivable. If they don&#x27;t want to break compatibility it&#x27;s pretty simple: use something like PHPass and upgrade the hash when the user next logs in. i.e. what every halfway sensible web app did at least five years ago.