Executive brief
JetBrains PhpStorm, a popular development environment for PHP developers, contained a security flaw that could allow malicious code to run automatically when opening a project. This bypasses the 'Project Trust' safety mechanism designed to protect users from untrusted code. An attacker could use this to gain full control over a developer's workstation or steal sensitive source code and credentials.
Technical details
A vulnerability in JetBrains PhpStorm (versions prior to 2026.2) allowed for arbitrary code execution by exploiting project tooling mechanisms. The flaw is categorized as CWE-829 (Inclusion of Functionality from Untrusted Control Sphere), where the IDE would execute scripts or binaries associated with project tools before the user explicitly confirmed the project was trusted. This local attack vector allows an attacker to achieve full system compromise (High Confidentiality, Integrity, and Availability impact) simply by having a user open a malicious project directory. The issue has been addressed in PhpStorm version 2026.2.
Affected products
- JetBrains PhpStorm before 2026.2
Timeline
- 2026-07-23: advisory: CVE-2026-64808 published by JetBrains
- 2026-07-23: patched: Fixed in version 2026.2