The function in question in CakePHP is DefaultPasswordHasher::hash($password).
I've been going through some CakePHP tutorials: https://book.cakephp.org/3.0/en/tutorials-and-examples/bookmarks/intro.html and https://www.tutorialspoint.com/cakephp/cakephp_configuration.htm. From the latter, I'm seeing one big salt string used for hashing in the Security.salt section.
Is this one salt string used for all users when hashing user passwords? I tried looking through the source code, but didn't have much luck. Maybe I'm missing something, but it seems like using the same salt for all users would defeat the purpose of salting in the first place.