Timing Attacks are real, and most devs don't protect against them
Recently Alexandre has been putting out some great tweets with some really interesting PHP Related things in this one he talks about timing attacks in PHP giving examples of how we as devs are not protecting against them. If you're not following Alexandre on X already I suggest you do as he's been putting out some great insights into the PHP language.