{"schema_version":1,"title":"Jetbrains PhpStorm vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 6 vulnerabilities in Jetbrains PhpStorm: 2 in the last 7 days and 4 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-123858, was published on 6 November 2026. 4 vulnerabilities in the last four weeks, up from none in the four before. 1 critical against 0.","url":"https://junglewise.ai/threats/technologies/phpstorm","json_url":"https://junglewise.ai/threats/technologies/phpstorm.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/phpstorm","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","thin":false,"counts":{"high":3,"all_time":6,"critical":1,"exploited":0,"last_7_days":2,"last_30_days":4,"last_90_days":4,"last_365_days":6},"latest":[{"cve":"CVE-2026-123858","cvss":4.4,"slug":"cve-2026-123858-in-jetbrains-phpstorm-before-2026-3-project-files-could-be","title":"JetBrains PhpStorm automatic project file upload to deployment server","severity":"medium","exploited":false,"published_at":"2026-11-06T17:17:25.177+00:00","url":"https://junglewise.ai/threats/cve-2026-123858-in-jetbrains-phpstorm-before-2026-3-project-files-could-be"},{"cve":"CVE-2026-123857","cvss":4.3,"slug":"cve-2026-123857-in-jetbrains-phpstorm-before-2026-3-xxe-was-possible-in","title":"JetBrains PhpStorm XML external entity injection in PHPMD ruleset autodetection","severity":"medium","exploited":false,"published_at":"2026-11-06T17:17:25.023+00:00","url":"https://junglewise.ai/threats/cve-2026-123857-in-jetbrains-phpstorm-before-2026-3-xxe-was-possible-in"},{"cve":"CVE-2026-118697","cvss":9,"slug":"cve-2026-118697-in-jetbrains-toolbox-app-before-3-9-1-and-3-8-2-intellij-idea","title":"JetBrains Toolbox App and IDEs compromised certificate trust","severity":"critical","exploited":false,"published_at":"2026-10-30T18:17:24.687+00:00","url":"https://junglewise.ai/threats/cve-2026-118697-in-jetbrains-toolbox-app-before-3-9-1-and-3-8-2-intellij-idea"},{"cve":"CVE-2026-118696","cvss":8,"slug":"cve-2026-118696-in-jetbrains-intellij-idea-pycharm-phpstorm-rubymine-and","title":"JetBrains IDEs embedded browser trusted revoked certificates","severity":"high","exploited":false,"published_at":"2026-10-30T18:17:24.53+00:00","url":"https://junglewise.ai/threats/cve-2026-118696-in-jetbrains-intellij-idea-pycharm-phpstorm-rubymine-and"},{"cve":"CVE-2026-64809","cvss":8.4,"slug":"cve-2026-64809-jetbrains-phpstorm-arbitrary-code-execution-via-configured","title":"JetBrains PhpStorm arbitrary code execution via configured interpreter","severity":"high","exploited":false,"published_at":"2026-07-23T12:18:36.437+00:00","url":"https://junglewise.ai/threats/cve-2026-64809-jetbrains-phpstorm-arbitrary-code-execution-via-configured"},{"cve":"CVE-2026-64808","cvss":8.4,"slug":"cve-2026-64808-jetbrains-phpstorm-arbitrary-code-execution-in-project-tooling","title":"JetBrains PhpStorm arbitrary code execution in project tooling","severity":"high","exploited":false,"published_at":"2026-07-23T12:18:36.323+00:00","url":"https://junglewise.ai/threats/cve-2026-64808-jetbrains-phpstorm-arbitrary-code-execution-in-project-tooling"}],"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-26","critical":1,"exploited":0,"vulnerabilities":2},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":2},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"Jetbrains YouTrack","slug":"youtrack","vulnerabilities":83,"url":"https://junglewise.ai/threats/technologies/youtrack"},{"name":"Jetbrains IntelliJ IDEA","slug":"intellij-idea","vulnerabilities":51,"url":"https://junglewise.ai/threats/technologies/intellij-idea"},{"name":"Jetbrains TeamCity","slug":"teamcity","vulnerabilities":34,"url":"https://junglewise.ai/threats/technologies/teamcity"},{"name":"Jetbrains Datalore","slug":"datalore","vulnerabilities":16,"url":"https://junglewise.ai/threats/technologies/datalore"},{"name":"Jetbrains Hub","slug":"hub","vulnerabilities":11,"url":"https://junglewise.ai/threats/technologies/hub"},{"name":"Jetbrains Webstorm","slug":"webstorm","vulnerabilities":8,"url":"https://junglewise.ai/threats/technologies/webstorm"},{"name":"Jetbrains GoLand","slug":"goland","vulnerabilities":7,"url":"https://junglewise.ai/threats/technologies/goland"},{"name":"Jetbrains PyCharm","slug":"pycharm","vulnerabilities":7,"url":"https://junglewise.ai/threats/technologies/pycharm"},{"name":"Jetbrains CLion","slug":"clion","vulnerabilities":6,"url":"https://junglewise.ai/threats/technologies/clion"},{"name":"Jetbrains Rider","slug":"rider","vulnerabilities":4,"url":"https://junglewise.ai/threats/technologies/rider"},{"name":"Jetbrains Toolbox App","slug":"toolbox-app","vulnerabilities":4,"url":"https://junglewise.ai/threats/technologies/toolbox-app"},{"name":"Jetbrains Junie CLI","slug":"junie-cli","vulnerabilities":3,"url":"https://junglewise.ai/threats/technologies/junie-cli"}],"technology":{"hub":true,"name":"Jetbrains PhpStorm","slug":"phpstorm","vendor":{"hub":true,"name":"Jetbrains","slug":"jetbrains","url":"https://junglewise.ai/threats/vendors/jetbrains"},"aliases":[],"category":"IDE","homepage":"https://www.jetbrains.com/phpstorm/","description":"PhpStorm is a PHP integrated development environment by JetBrains.","url":"https://junglewise.ai/threats/technologies/phpstorm"},"most_severe":[{"cve":"CVE-2026-118697","cvss":9,"slug":"cve-2026-118697-in-jetbrains-toolbox-app-before-3-9-1-and-3-8-2-intellij-idea","title":"JetBrains Toolbox App and IDEs compromised certificate trust","severity":"critical","exploited":false,"published_at":"2026-10-30T18:17:24.687+00:00","url":"https://junglewise.ai/threats/cve-2026-118697-in-jetbrains-toolbox-app-before-3-9-1-and-3-8-2-intellij-idea"},{"cve":"CVE-2026-64809","cvss":8.4,"slug":"cve-2026-64809-jetbrains-phpstorm-arbitrary-code-execution-via-configured","title":"JetBrains PhpStorm arbitrary code execution via configured interpreter","severity":"high","exploited":false,"published_at":"2026-07-23T12:18:36.437+00:00","url":"https://junglewise.ai/threats/cve-2026-64809-jetbrains-phpstorm-arbitrary-code-execution-via-configured"},{"cve":"CVE-2026-64808","cvss":8.4,"slug":"cve-2026-64808-jetbrains-phpstorm-arbitrary-code-execution-in-project-tooling","title":"JetBrains PhpStorm arbitrary code execution in project tooling","severity":"high","exploited":false,"published_at":"2026-07-23T12:18:36.323+00:00","url":"https://junglewise.ai/threats/cve-2026-64808-jetbrains-phpstorm-arbitrary-code-execution-in-project-tooling"},{"cve":"CVE-2026-118696","cvss":8,"slug":"cve-2026-118696-in-jetbrains-intellij-idea-pycharm-phpstorm-rubymine-and","title":"JetBrains IDEs embedded browser trusted revoked certificates","severity":"high","exploited":false,"published_at":"2026-10-30T18:17:24.53+00:00","url":"https://junglewise.ai/threats/cve-2026-118696-in-jetbrains-intellij-idea-pycharm-phpstorm-rubymine-and"},{"cve":"CVE-2026-123858","cvss":4.4,"slug":"cve-2026-123858-in-jetbrains-phpstorm-before-2026-3-project-files-could-be","title":"JetBrains PhpStorm automatic project file upload to deployment server","severity":"medium","exploited":false,"published_at":"2026-11-06T17:17:25.177+00:00","url":"https://junglewise.ai/threats/cve-2026-123858-in-jetbrains-phpstorm-before-2026-3-project-files-could-be"},{"cve":"CVE-2026-123857","cvss":4.3,"slug":"cve-2026-123857-in-jetbrains-phpstorm-before-2026-3-xxe-was-possible-in","title":"JetBrains PhpStorm XML external entity injection in PHPMD ruleset autodetection","severity":"medium","exploited":false,"published_at":"2026-11-06T17:17:25.023+00:00","url":"https://junglewise.ai/threats/cve-2026-123857-in-jetbrains-phpstorm-before-2026-3-xxe-was-possible-in"}],"generated_at":"2026-11-09T03:07:00.176479+00:00"}