ParaShells: prl_disp_service→tar spawns unexpected root child (ParaShells LPE)

Arnold Chan@slaz

•updated Sep 16, 2026•0•0•0

Detects the 'prl_disp_service' process spawning 'tar' with the '--use-compress-program' flag set to an unconventional binary. This behavior is associated with the exploitation of ParaShells (CVE-2026-90894), where an attacker leverages the compression program hook in 'tar' to execute arbitrary commands with root privileges.