They vary; generally, their maintainers mean well but that doesn't necessarily translate to secure code.
Cake lacks security expertise in their core team, unfortunately.
CodeIgniter is a bit conservative. (We must support PHP 5.2!) But then again, so is WordPress. They do listen to researchers.
Laravel is okay, but their lead dev is a bit of an egotistical and hypocritical ass. Recently, found and privately reported a PHP Object Injection vuln to Laravel; he said he didn't consider it a security issue, then when I disclosed publicly flipped his shit on me.
Symfony is great. Fabien has a cool head and responds well to security researchers.
Yii 2 is promising. I'll have to take another look before I call it bulletproof though.
My only experience with Zend has been interacting with their core devs on other media (Twitter, IRC); I haven't found any bugs in its core.
Cake lacks security expertise in their core team, unfortunately.
CodeIgniter is a bit conservative. (We must support PHP 5.2!) But then again, so is WordPress. They do listen to researchers.
Laravel is okay, but their lead dev is a bit of an egotistical and hypocritical ass. Recently, found and privately reported a PHP Object Injection vuln to Laravel; he said he didn't consider it a security issue, then when I disclosed publicly flipped his shit on me.
Symfony is great. Fabien has a cool head and responds well to security researchers.
Yii 2 is promising. I'll have to take another look before I call it bulletproof though.
My only experience with Zend has been interacting with their core devs on other media (Twitter, IRC); I haven't found any bugs in its core.