What is wrong with bcrypt?

They left debug code in production, simple as that.

And there ain't nothing wrong with bcrypt; It's secure.
You should however use Argon2 instead, if you can.
http://php.net/manual/en/function.password-hash.php