When available,
/dev/urandom and COM gets used on *nix and
Windows systems,
respectively.
If all else fails, a Mersenne Twister gets used. (Strictly
speaking, this fallback is inadequate, but good enough.)
Note: Users restricting path access through the
open_basedir INI setting,
will need to include
/dev/urandom into the list of allowed paths, as this
method might read from
/dev/urandom.