Between 23 Sep and 7 Oct 2026, four Drupal contrib modules got advisories for the same bug class — user strings evaluated as Twig. Plus the 14 Oct core release window, and the fifteen-minute audit I ran on my own VPS.
Craft and Drupal both theme with Twig, which fools you into thinking the front end will feel familiar. It doesn't — the template IS the controller, and query and cache discipline quietly become yours.
Craft added an opt-in Twig sandbox in 5.9, and all through 2026 it has kept producing authenticated-RCE advisories. A Drupal dev's notes on why letting editors run Twig is a privilege-escalation feature wherever you do it.
