Severe Twig Vulnerability Allows Arbitrary Code Execution in Ubuntu 26.04 LTS

Linuxsecurity

Severe Twig Vulnerability Allows Arbitrary Code Execution in Ubuntu 26.04 LTS

First seen 9 Jun 2026, 02:56 UTC • •72.0

Article Content

1 / 3

Browse articles

ThreatCluster •June 10, 2026 at 02:29 UTC

•Twig vulnerability allows arbitrary code execution via crafted network traffic.
•Affected systems include Ubuntu 26.04 LTS and its derivatives.
•Users should update to php-twig version 3.23.0-2ubuntu0.1~esm1 to mitigate risks.

A critical vulnerability in the Twig template engine affects Ubuntu 26.04 LTS and its derivatives. Discovered on June 8, 2026, the flaw allows an authenticated user to execute arbitrary code by sending specially crafted network traffic. The issue arises from improper validation of PHP callables in Twig when using a source policy. Users are advised to update to php-twig version 3.23.0-2ubuntu0.1~esm1 to mitigate the risk. This vulnerability poses a significant threat to systems running affected versions of Ubuntu. A standard system update will also apply the necessary changes. Ubuntu Pro users benefit from extended security coverage for this issue. The vulnerability is tracked under USN-8408-1.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 93d ago How this analysis works

Timeline

2026-06-08

Twig vulnerability discovered

The vulnerability allows authenticated users to execute arbitrary code due to improper validation of PHP callables.

2026-06-09

Security advisory published

Linuxsecurity reports on the Twig vulnerability, urging users to update their systems to prevent exploitation.

More articles in this cluster (2)

Threat Graph

7 entities, 8 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (2)

Zero-day Exploit
T1203 - Exploitation for Client Execution

Organization (1)

Ubuntu

Weakness (1)

CWE-94 - Code Injection

Affected Platform (2)

Php-twig
Twig

Vulnerability (1)

Twig Vulnerability

Relationships

Twig Vulnerability targets Php-twig
Twig Vulnerability targets Twig
Zero-day Exploit targets Php-twig
Zero-day Exploit targets Twig
T1203 - Exploitation for Client Execution targets Php-twig
T1203 - Exploitation for Client Execution targets Twig
Twig Vulnerability related to Ubuntu
Twig Vulnerability related to CWE-94 - Code Injection

Following this threat?

Track Ubuntu in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical Cisco FMC Vulnerabilities Under Active Exploitation Cisco's Secure Firewall Management Center (FMC) Software has two critical vulnerabilities, CVE-2026-20079 and CVE-2026-20316, that are currently being exploited by state-sponsored and ransomware actors. CVE-2026-20079, rated 10.0 on the CVSS scale, allows unauthenticated remote attackers to bypass authentication and…

BlueMoon Exploit Kit Targeting Chrome and Windows by Multiple State Actors A new exploit kit named BlueMoon has been rapidly adopted by at least four espionage groups, primarily linked to China, exploiting vulnerabilities in Google Chrome and Microsoft Windows. The first observed use of BlueMoon was on August 28, 2026, by the China-aligned threat actor TA412, with subsequent adoption by…