I cannot reproduce this problem. Attached is an export of a rule which fires when a comment is added to an Article or when a comment on an Article is updated. The Rule simply prints a system message containing the CID so that you can see the Rule was able to access the CID. I have tested this and I always get the message, with the CID, when adding or updating a comment.
{ "rules_comment_added_or_updated" : {
"LABEL" : "Comment added or updated",
"PLUGIN" : "reaction rule",
"OWNER" : "rules",
"REQUIRES" : [ "rules_i18n", "rules", "comment" ],
"ON" : {
"comment_insert--comment_node_article" : { "bundle" : "comment_node_article" },
"comment_update--comment_node_article" : { "bundle" : "comment_node_article" }
},
"DO" : [
{ "drupal_message" : { "message" : "Comment id = \u0022[comment:cid]\u0022" } }
]
}
}
Note that in general you should not be using PHP code except as a last resort. It would be much better to use a custom action or condition instead. Both ways require writing PHP, but a custom action or condition is secure. In any case, neither is needed here.