Arbitrary code execution in JetBrains PhpStorm before project trust (CVE-2026-64809)

A vulnerability in JetBrains PhpStorm allows arbitrary code execution before a user has granted project trust, triggered via the configured interpreter. This bypasses the project trust security boundary, potentially allowing malicious code from an untrusted project to execute without user consent. Affected versions: - PhpStorm before 2026.2 We recommend updating to: 2026.2. CVSS 8.4 · our assessment: this_week Reference: https://www.jetbrains.com/privacy-security/issues-fixed/ Details: https://vuln.today/cve/CVE-2026-64809