Twig 3.26.0 is a security-focused release addressing 13 CVEs, including two critical PHP code injection vulnerabilities via the compiled cache. Most issues target the sandbox component used to run untrusted templates. Critical fixes include arbitrary PHP injection through `_self.(<string>)` macro syntax and `{% use %}` template names. High-severity fixes address sandbox bypasses via object-destructuring, unguarded `__toString()` coercions, and source policy mishandling. Medium issues cover the `column` filter bypassing property allow-lists, incomplete sandbox checks on cached includes, and `template_from_string` escaping source policies. Low-severity fixes address XSS in the profiler HtmlDumper, unsafe `is_safe` annotations on HTML-emitting filters, and unbounded formatter memoization in `twig/intl-extra`. All users running untrusted templates through the sandbox should upgrade immediately.
