Phpstorm CVE-2026-64808

PhpStorm versions before 2026.2 contain a critical flaw in their project trust model that allows arbitrary code execution when developers open untrusted projects, putting development teams at direct risk of intellectual property theft and compromised software builds. Successful exploitation could enable threat actors to inject malicious code into shipped products or internal infrastructure. Every development team using affected PhpStorm versions requires urgent mitigation.

Within 24 hours, inventory all PhpStorm installations earlier than version 2026.2 across development teams and communicate this vulnerability advisory; simultaneously disable auto-execution features for project-level tooling and scripts in PhpStorm settings. Within 7 days, enforce policy requiring manual security review and explicit approval before developers open external repositories, configure PhpStorm to require explicit user trust approval for all projects, and deploy logging to detect suspicious child process execution from PhpStorm. Within 30 days, upgrade all affected PhpStorm installations to version 2026.2 or later once released by JetBrains, and conduct developer security training on identifying and reporting suspicious project structures.

Disable auto-execution of project tools and scripts in IDE settings; require explicit manual approval before opening untrusted repositories; implement enhanced logging and monitoring for process execution spawned by PhpStorm; enforce mandatory security code review before external projects are opened; and provide developer training on suspicious project artifacts.