Back Linuxsecurity

Ubuntu 26.04 LTS php-twig Severe Arbitrary Code Execution Flaw USN-8408

Linuxsecurity •LinuxSecurity Advisories • June 9, 2026

A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 26.04 LTS Summary: Twig could be made to run programs if it received specially crafted network traffic from an authenticated user. Software Description: - php-twig: Flexible, fast, and secure template engine for PHP Details: It was discovered that Twig did not properly validate PHP callables when using a source policy. An authenticated user could possibly use this issue to execute arbitrary code.

The problem can be corrected by updating your system to the following package versions: Ubuntu 26.04 LTS php-twig 3.23.0-2ubuntu0.1~esm1 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes.

Ubuntu Security Notice USN-8408-1

Get the latest Linux and open source security news straight to your inbox.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Severe Twig Vulnerability Allows Arbitrary Code Execution in Ubuntu 26.04 LTS A critical vulnerability in the Twig template engine affects Ubuntu 26.04 LTS and its derivatives. Discovered on June 8, 2026, the flaw allows an authenticated user to execute arbitrary code by sending specially crafted network traffic. The issue arises from improper validation of PHP callables in Twig when using a source policy. Users are advised to update to php-twig version 3.23.0-2ubuntu0.1~esm1 to mitigate the risk. This vulnerability poses a significant threat to systems running affected versions of Ubuntu. A standard system update will also apply the necessary changes. Ubuntu Pro users benefit from extended security coverage for this issue. The vulnerability is tracked under USN-8408-1. 2 sources 72

Ubuntu 26.04 LTS php-twig Severe Arbitrary Code Execution Flaw USN-8408

The full story

Extracted Entities

Companies (1)

Platforms (2)