From my experience, going through a vanilla php app to fix a CVE is a much better experience than praying to the Framework Powers that be to have your patch ready and non-breaking when you need it.