Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 491
Alerts This Week
Warning Icon 1 491

Ubuntu 26.04 LTS php-twig Severe Arbitrary Code Execution Flaw USN-8408-1

ubuntu
Calendar Grey June 8, 2026
Scroller Ubuntu
Twig vulnerability on Ubuntu allows unauthorized program execution via crafted network traffic. Update recommended immediately.
Twig could be made to run programs if it received specially crafted network traffic from an authenticated user.

Summary

Twig could be made to run programs if it received specially crafted network

traffic from an authenticated user.

Software Description:

- php-twig: Flexible, fast, and secure template engine for PHP

Details:

It was discovered that Twig did not properly validate PHP callables when

using a source policy. An authenticated user could possibly use this issue

to execute arbitrary code.

Topics%20covered

Topics Covered

security advisory arbitrary code execution Ubuntu important update required php-twig

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 26.04 LTS
  php-twig                        3.23.0-2ubuntu0.1~esm1
                                  Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-8408-1

CVE-2026-24425

Severity
important
Lowest
Low
Medium
High
Critical

Ubuntu Security Notice USN-8408-1

Topics%20covered

Topics Covered

security advisory arbitrary code execution Ubuntu important update required php-twig

Package Information

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.