CVE-2026-64809: 
NixOS 脆弱性の分析と軽減

CVE-2026-64809 is an arbitrary code execution vulnerability in JetBrains PhpStorm that allows a local attacker to execute code before the user grants project trust via the configured interpreter. All versions of PhpStorm prior to 2026.2 are affected. The CVE was published on July 23, 2026, and was assigned by JetBrains s.r.o. It carries a CVSS v3.1 base score of 8.4 (High), as assessed by JetBrains (JetBrains Advisory, NVD).

The root cause is classified as CWE-829 (Inclusion of Functionality from Untrusted Control Sphere), meaning PhpStorm incorporates or executes functionality sourced from an untrusted context — specifically, the configured PHP interpreter — before the IDE's project trust mechanism has been invoked or confirmed by the user. This allows a malicious project (e.g., one cloned from an untrusted repository) to trigger code execution through the interpreter configuration without requiring elevated privileges or user interaction beyond opening the project. The attack vector is local, with low attack complexity and no privileges required (NVD, JetBrains Advisory). No public PoC exploit code has been identified at this time.

Successful exploitation results in high impact to confidentiality, integrity, and availability on the affected system, as indicated by the CVSS scoring. An attacker who can place a malicious project on the victim's machine — for example, via a shared repository or social engineering — could achieve arbitrary code execution in the context of the user running PhpStorm, without any privilege escalation or user interaction beyond opening the project. This could lead to data theft, installation of persistent malware, or further lateral movement within the developer's environment (NVD, JetBrains Advisory).

1. Prepare malicious project: An attacker crafts a PhpStorm project that includes a malicious or attacker-controlled PHP interpreter path in the project's configuration files (e.g., .idea/ directory settings).
2. Deliver the project: The attacker distributes the malicious project to the target developer, for example via a public or private Git repository, a shared archive, or social engineering.
3. Victim opens the project: The target developer opens the project in a vulnerable version of PhpStorm (before 2026.2). At this stage, the IDE has not yet prompted for or received project trust confirmation.
4. Interpreter executes before trust check: PhpStorm invokes the configured (attacker-controlled) interpreter prior to completing the project trust validation flow, triggering execution of arbitrary code in the context of the developer's user account.
5. Achieve objective: The attacker's payload executes with the developer's privileges, enabling data exfiltration, persistence, or further compromise of the development environment (NVD, JetBrains Advisory).

• File System: Unexpected or modified .idea/php.xml or other PhpStorm project configuration files pointing to an unusual or external interpreter path; presence of unfamiliar executables referenced as PHP interpreters.
• Process: Unusual child processes spawned by the PhpStorm process (e.g., unexpected scripts, shells, or binaries) shortly after a project is opened, particularly before any trust dialog is displayed.
• Logs: PhpStorm logs (located in the IDE's log directory) showing interpreter invocation events prior to project trust being granted; unexpected process execution entries in OS audit logs tied to the PhpStorm process.
• Network: Outbound network connections initiated by processes spawned from PhpStorm to unknown external hosts, potentially indicating a reverse shell or data exfiltration payload.

JetBrains has released PhpStorm version 2026.2, which resolves this vulnerability. Users should update to PhpStorm 2026.2 or later as the primary remediation (JetBrains Advisory). As a workaround prior to patching, developers should avoid opening projects from untrusted or unknown sources, and should manually review .idea/ configuration files — particularly interpreter settings — before opening any externally sourced project. No additional configuration-based mitigations have been published by JetBrains.