ParaShells: Non-root process connects to world-writable prl_disp_service socket

Arnold Chan@slaz

•updated Sep 16, 2026•0•0•0

Detects unauthorized or non-privileged processes attempting to communicate with the Parallels Desktop IPC Unix socket (prl_disp_service.socket). This behavior is indicative of exploitation attempts targeting the ParaShells vulnerability (CVE-2026-90894), where an unprivileged user can leverage the socket's lack of proper signature or identity verification to escalate privileges.