I'd sort of hope they weren't using PHP's built-in crypto or any crypto library that deals in null-terminated strings. Judging from their careers pages, they use no PHP, so this shouldn't apply.