Critical PHP Injection Vulnerability Patched in Twig Template Engine
A critical vulnerability in Twig versions prior to 3.26.0 allows attackers to inject arbitrary PHP code via crafted template names in {% use %} tags.
A critical security vulnerability, identified as CVE-2026-46633, has been discovered in the Twig template language for PHP. The flaw exists in the Compiler::string() method, which fails to properly escape single quotes when handling template names used within {% use %} tags. This oversight allows a crafted template name to terminate a PHP single-quoted string literal, enabling the injection of arbitrary PHP expressions into the compiled cache file.
With a CVSS score of 9.8, this vulnerability is classified as critical, as it allows for unauthorized code execution with high impact on confidentiality, integrity, and availability. The issue affects all versions of Twig prior to 3.26.0. Users are strongly advised to update their Twig installations to version 3.26.0 or later to mitigate this risk.
Sources
- NVD Original source
Continue Reading
SecurityNewLXD, MicroCloud flaw lets clients be impersonated
Canonical patched a maximum-severity LXD and MicroCloud bug that let attackers assume a trusted client's identity without its private key.
SecurityA hands-on way to gauge AI ransomware risk
OWASP volunteers released RAID-AI, a free manual self-assessment that maps AI controls to NIST and CISA frameworks.
SecurityAWS AgentCore Flaw Let One Prompt Hijack All Agents
Researchers say a single chat prompt could extract cloud credentials and let an attacker take over every AgentCore agent in an AWS account and region.