Note that RSA can actually be defined by performing the operations in the exponent modulo the Carmicheal function $\lambda(N)=\textrm{lcm}(p-1,q-1)$ more efficiently than the Euler totient function $\varphi(n)=(p-1)(q-1)$ as it is traditionally viewed.

Let $C=M^e~(mod~N)$ be the ciphertext. Define the sequence  $$X_0=M,\quad X_i=X_{i-1}^e~(mod~N),\quad i\geq 1.$$

This will repeat at some point, and the smallest $k$ such that $X_{k+1}=X_1$ is denoted the period of $M.$ This $k$ is unique
and is also the order of $e$ modulo $\lambda(N)$, so it divides $w.$ Thus $k$ divides $\lambda(\lambda(N))$ and $\phi(\lambda(N))$ and $O(k)$ RSA evaluations can break the cipher. Of course $k\leq w,$ so at worst $O(w)$ evaluations may be needed.

This attack is called the message iteration attack and to prevent it being efficient both $\lambda(\lambda(N))$ and $k,$ the order of $e$ with respect to $\lambda(N)$ have to be large enough, say $10^{200}.$ For this one uses doubly safe primes $p$ and $q.$ Note that $p$ is doubly safe if both $(p-1)/2$ and $(p-3)/4$ are also primes.