JetBrains PhpStorm CVE-2026-64809

Exploitation requires the victim to open an attacker-supplied project in a vulnerable PhpStorm (before 2026.2) that contains a malicious 'configured interpreter' setting; the code runs during project loading before the user grants project trust, so the trust prompt does NOT limit it. Limiting factors: the attack is local (AV:L) and depends on a developer actually opening a hostile project - it cannot be triggered remotely without that action - and it only affects PhpStorm builds prior to 2026.2; code executes with the privileges of the developer running the IDE. Note the scoring conflict: NVD marks UI:N, but the description's 'opening a project' step is effectively user interaction, which defenders should weigh when assessing realistic exposure.

The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 8.4 High) indicates a local attack vector with low complexity, no privileges, and - as scored by NVD - no user interaction, yielding full confidentiality, integrity, and availability impact. There is tension in these signals worth flagging: the description explicitly requires a developer to open a malicious project, which is realistically a user-interaction event, yet the vector is scored UI:N; defenders should treat this as a social-engineering / supply-chain-of-source style bug (victim clones and opens a hostile repository) rather than a remotely triggerable RCE. No EPSS score, KEV entry, or POC was provided, so exploitation probability cannot be quantified from the data; the absence of KEV means no confirmed active exploitation. Real-world priority is moderate-to-high for developer endpoints because opening untrusted repositories is a common workflow, but the local vector and reliance on victim action make mass exploitation unlikely versus targeted developer compromise.

An attacker publishes a repository (or ships a project archive) containing a crafted interpreter configuration pointing at an attacker-controlled command. A developer clones and opens the project in a pre-2026.2 PhpStorm; before the trust dialog is acknowledged, the IDE invokes the configured interpreter and the attacker's code runs with the developer's privileges. No public exploit is identified at time of analysis, but the low attack complexity makes a working exploit straightforward to construct.