Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
Twig is a template language for PHP. From 3.15.0 until 3.26.0, _self.(<string>) and import-alias dynamic attribute syntax can concatenate an attacker-controlled string into a MacroReferenceExpression name without identifier validation, causing raw PHP to be emitted into the generated template source and executed at template-load time. This issue is fixed in version 3.26.0.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-05-24 | 1 | PoC1 |
| 2026-06-07 | 2 | General1PoC1 |
| 2026-06-08 | 1 | General1 |
| 2026-06-09 | 1 | PoC1 |
| 2026-06-13 | 1 | PoC1 |
| 2026-09-21 | 1 | Exploit1 |
CVE-2026-46640: Developing payloads for Twig sandbox bypass https://gist.github.com/vladko312/39507beaa58eacf3b62e6a6e6cd69128
Post summary
The post announces CVE-2026-46640 and provides a GitHub gist with payload code targeting a Twig sandbox bypass, indicating a PoC is available.
CVE-2026-46640: Developing payloads for Twig sandbox bypass https://gist.github.com/vladko312/39507beaa58eacf3b62e6a6e6cd69128
Post summary
The text announces a PoC for CVE-2026-46640, providing a link to payload code that bypasses Twig's sandbox. No evidence of active exploitation, patches, or mitigations is mentioned.
@GsInfosystems And with the AI-induced amount of CVEs it is even harder to separate exploitable ones from useless "technically a vuln" stuff. For example, I created the payload for CVE-2026-46640 and it was not as easy as AI might suggest. And for CVE-2026-46633 I have only partial success.
Post summary
The author claims to have developed a payload (exploit) for CVE-2026-46640 and only partially succeeded for CVE-2026-46633, indicating exploit development effort.
Top 5 Trending CVEs: 1 - CVE-2026-9366 2 - CVE-2026-42945 3 - CVE-2026-46640 4 - CVE-2026-49261 5 - CVE-2020-0022 #cve #cvetrends #cveshield #cybersecurity https://www.cveshield.com/dashboard
Post summary
The tweet enumerates the top five trending CVEs but provides no additional information about exploits, patches, or technical details.
ثغرة جديدة تكشف حدود عزل القوالب. يوضح CVE-2026-46640 كيف يمكن لتجاوز Twig sandbox أن يفتح مساراً لهجمات عبر Payloads مصممة بدقة. CVE-2026-46640 highlights how Twig sandbox bypass payloads can turn template logic into an attack path. Key takeaway: template isolation needs strict validation, not reliance on sandboxing alone. https://gist.github.com/vladko312/39507beaa58eacf3b62e6a6e6cd69128 #CVE2026 #Twig #AppSec
Post summary
The post announces CVE-2026-46640, a Twig sandbox bypass that allows crafted payloads to create an attack path, and shares a Gist link containing a PoC illustrating the exploitation.
@watchtowrcyber It would be interesting to see your attempt to reproduce RCE using CVE-2026-46633. It has CVSSv4 of 9.3 and could act as RCE payload for most Twig versions, sandboxed or not, including previously unexploitable ones. Still, there are no known RCE payloads, unlike CVE-2026-46640.
Post summary
The post highlights CVE-2026-46633 as a high‑severity RCE vulnerability in Twig, noting its CVSS of 9.3 and potential impact, but states that no exploits or fixes are known yet.
@AnthropicAI Mythos recently found multiple sandbox bypasses in Twig. For CVE-2026-46640, I made a PoC module for SSTImap, but it was not as trivial as the description might imply. As for CVE-2026-46633, I'm stuck after getting code injection. Can @AnthropicAI help prove it to be exploitable?
Post summary
The author shares a PoC module for CVE‑2026‑46640, notes sandbox bypasses in Twig, and requests assistance with making CVE‑2026‑46633 exploitable after encountering code injection.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | symfony | twig | - | - | - |