I typed this up on the bus, forgot to summarize what it does:

• random_bytes()
  • uses mcrypt_create_iv() with MCRYPT_DEV_URANDOM if it's available and on a safe PHP version
  • uses openss_random_pseudo_bytes()
  • reads from /dev/urandom as a fallback (PHP < 5.3.7)
  • TODO: add CAPICOM support (a'la my WordPress patch)
• random_hex() just grabs data from random_bytes() and converts it to hex
• random_int() uses random_bytes() to create an integer