diff --git a/core/lib/Drupal/Core/DrupalKernel.php b/core/lib/Drupal/Core/DrupalKernel.php
index 9714106..7d390ce 100644
--- a/core/lib/Drupal/Core/DrupalKernel.php
+++ b/core/lib/Drupal/Core/DrupalKernel.php
@@ -253,7 +253,7 @@ public static function createFromRequest(Request $request, $class_loader, $envir
         && Settings::get('class_loader_auto_detect', TRUE)
         && Settings::get('hash_salt', FALSE)
         && function_exists('apc_fetch')) {
-      $prefix = 'drupal.' . hash('sha256', 'drupal.' . Settings::getHashSalt());
+      $prefix = 'drupal.' . hash_hmac('sha256', 'drupal', Settings::getHashSalt());
       $apc_loader = new \Symfony\Component\ClassLoader\ApcClassLoader($prefix, $class_loader);
       $class_loader->unregister();
       $apc_loader->register();
@@ -431,7 +431,7 @@ public function boot() {
       }
     }
     FileCacheFactory::setConfiguration($configuration);
-    FileCacheFactory::setPrefix(hash('sha256', 'FileCache' . Settings::get('hash_salt')));
+    FileCacheFactory::setPrefix(hash_hmac('sha256', 'FileCache', Settings::getHashSalt()));
 
     // Initialize the container.
     $this->initializeContainer();
diff --git a/core/lib/Drupal/Core/Session/PermissionsHashGenerator.php b/core/lib/Drupal/Core/Session/PermissionsHashGenerator.php
index f176afd..2df7759 100644
--- a/core/lib/Drupal/Core/Session/PermissionsHashGenerator.php
+++ b/core/lib/Drupal/Core/Session/PermissionsHashGenerator.php
@@ -83,7 +83,7 @@ protected function doGenerate(array $roles) {
       sort($permissions);
       $permissions_by_role[$role] = $permissions;
     }
-    return hash('sha256', $this->privateKey->get() . Settings::getHashSalt() . serialize($permissions_by_role));
+    return hash_hmac('sha256', serialize($permissions_by_role), $this->privateKey->get() . Settings::getHashSalt());
   }
 
 }
diff --git a/sites/default/default.settings.php b/sites/default/default.settings.php
index 3783d0a..7edb11f 100644
--- a/sites/default/default.settings.php
+++ b/sites/default/default.settings.php
@@ -403,7 +403,7 @@
  */
 /*
 if ($settings['hash_salt']) {
-  $prefix = 'drupal.' . hash('sha256', 'drupal.' . $settings['hash_salt']);
+  $prefix = 'drupal.' . hash_hmac('sha256', 'drupal', $settings['hash_salt']);
   $apc_loader = new \Symfony\Component\ClassLoader\ApcClassLoader($prefix, $class_loader);
   unset($prefix);
   $class_loader->unregister();