A few weeks back I needed to port some crypto from Laravel to Go. I did not have too much trouble – apart the strange usage of Rijndael-256 that Laravel had until one version or two ago. When I looked at the way they were using keys to encrypt data, I realized that they were directly using "application private key". Is that bad? It shouldn't, but Laravel makes sure all the keys it generates are ASCII, for copy/pasting convenience. What happens if you're using a 256-bit key that can be represented with ASCII? The key space is 10^20 times smaller (the entropy of a byte in the key goes from 256 to 62!). That's been a thing in the most "modern framework" in PHP for more than three years. I'm far from being a security professional, but spending one hour on one file was enough to find a basic security issue. Let's just say we're not writing code with Laravel anymore.
I must mention that Taylor Otwell (the author) was extremely fast for fixing the problem. He is probably among the best open source project maintainers I know, and desserves to live off this work on Laravel.
Here is the commit: https://github.com/laravel/framework/commit/370ae34d41362c3a...
Frankly, writing web apps in Laravel is damn near a joy compared to the rest. We still do most of our big stuff with Java or Python and async/scripty stuff in Node, but a fair number of web apps that would've been Spring Framework by default a few years back have been very quickly whipped up in Laravel.
We've launched pretty heavy traffic sites in the last few years that have utilized Elastic Beanstalk, SQS, Elastic Search, and a whole host of other goodies that integrate very easily with Laravel.
It pretty much ships with everything you need to build an app: scaffolding, migrations, authentication, middleware, templating, caching. Most of getting up and running is really configuring a bunch of settings that takes virtually no time at all.
I'm a huge Laravel fan. They also have a slimmed down version called Lumen, which is pretty much specifically for APIs. Lumen stays up-to-date with Laravel, so you get the benefits of both worlds there.