PARASHELLS: PARALLELS DESKTOP TURNS APPLIANCE INSTALL INTO A ROOT SHELL

Summary from the TLDR InfoSec newsletter

CVE-2026-90894 lets a non-admin macOS user gain root through Parallels Desktop's appliance installer. JFrog tested Desktop 26.4.0 build 57513 on Apple Silicon. The root daemon exposes a world-writable Unix socket where an unsigned local process can authenticate through PrlSrv_LoginLocal. A quote in sVmParentPath injects tar's --use-compress-program option, and tar then launches an attacker script as root. Parallels released version 27.0.0 on September 1 to fix this issue.