CVE-2026-64809 is a vulnerability in JetBrains PhpStorm affecting versions prior to 2026.2. It allows an attacker to execute arbitrary code before the user grants project trust, leveraging the configured interpreter. This is categorized under CWE-829, which involves improper validation of a security-relevant condition. The vulnerability has a CVSS 3.1 score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating that it can be exploited locally without privileges or user interaction, resulting in high impact on confidentiality, integrity, and availability. No patch or official remediation level has been disclosed by JetBrains as of the publication date.

Successful exploitation can lead to arbitrary code execution on the affected system before project trust is granted, potentially compromising confidentiality, integrity, and availability of the system. This could allow attackers to run malicious code with the privileges of the user running PhpStorm.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when opening untrusted projects and consider limiting local access to PhpStorm installations to trusted users only.