Critical Twig template flaws let attackers run arbitrary PHP code

This alert outlines critical vulnerabilities in the Twig template language for PHP, specifically two remote code execution flaws: CVE-2026-46640 and CVE-2026-46633. CVE-2026-46640 involves a flaw in compiling dynamic attributes that can allow attackers to bypass security measures and execute arbitrary PHP code. CVE-2026-46633 arises from improper escaping of single quotes in the template compiler, which can lead to arbitrary expressions being loaded. To mitigate these issues, users are urged to upgrade to Twig version 3.26.0 or higher as soon as possible.