ParaShells: Sudo -i shell shortly after Parallels tar extraction error

Arnold Chan@slaz

•updated Sep 16, 2026•0•0•1

Detects interactive root shell requests via 'sudo -i' that occur shortly after a failed Parallels appliance installation or tar extraction event containing specific error codes or configuration markers (UCP_UID=0). This pattern aligns with the exploitation chain for CVE-2026-90894, where an attacker leverages an extraction failure to escalate privileges.