Checking it out - looks like your PHP lib doesn't explicitly declare CURLOPT_SSL_VERIFYHOST and CURLOPT_SSL_VERIFYPEER, so that could be vulnerable to peerjacking. If I have some free time tonight I might be able to submit a PR for it.