Alerts This Week
Warning Icon 1 975
Alerts This Week
Warning Icon 1 975

Ubuntu php-twig Critical Remote Code Execution Vulnerability USN-8408-1

ubuntu
Calendar Grey June 8, 2026
Dist Ubuntu Esm H88
This advisory highlights a critical security flaw in php-twig for Ubuntu enabling remote code execution. Update recommended.
Twig could be made to run programs if it received specially crafted network traffic from an authenticated user.

Summary

Twig could be made to run programs if it received specially crafted network

traffic from an authenticated user.

Software Description:

- php-twig: Flexible, fast, and secure template engine for PHP

Details:

It was discovered that Twig did not properly validate PHP callables when

using a source policy. An authenticated user could possibly use this issue

to execute arbitrary code.

Topics%20covered

Topics Covered

security advisory update critical remote code execution Ubuntu php-twig

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 26.04 LTS
  php-twig                        3.23.0-2ubuntu0.1~esm1
                                  Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-8408-1

CVE-2026-24425

Severity
critical
Lowest
Low
Medium
High
Critical

Ubuntu Security Notice USN-8408-1

Topics%20covered

Topics Covered

security advisory update critical remote code execution Ubuntu php-twig

Package Information

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here