1.8.x uses the standard PHPSecLib, which is installed using Composer.
1.7.x uses a customized version of PHPSecLib, which is in /fuel/core/vendor/phpseclib. I can't comment on why it can't find it, I am not familiar with Heroku. I don't see any immediate reason, Fuel has been using PHPSecLib this way for years.
Hotfix has been released. If you're on 1.8, a "composer update" should install it automatically.
Note that there is also an update of the public/index.php file. Depending on how you have constructed your local environment, it might not be updated by composer.
You are sure all files are there, you haven't by any change installed the PHPSecLib composer package (not supported before 1.8), all permissions are ok?
I see the V1.9 version has dropped the phpseclib package in composer - is that correct, or should it be included?
UPDATE:
So even with phpseclib required in composer.json, it refused to install anything under /fuel/vendor/phpseclib/ (Only an empty directory with no files) Only after deleting the folder "phpseclib" from the "vendor directory and running composer update again did it actually do and install something. So I'm not sure where the fault is here.
Finding this issue on a Joomla site that requires a Piwik package, have to delete the Piwik folder before running composer update to get it to do anything. So I'm officially blaming composer.