PHP bug: Password_verify() always return true with some hash

Flawless PHP logic. strtotime(): '00-00-00' means 2000-00-00, which is 1999-12-00, which is 1999-11-30. No bug, perfectly normal. (see the comments)