Xoscar/Xinference actor pool Python process spawning shell as root
Detects an Xoscar or Xinference Python actor pool process spawning a Unix shell child process with suspicious command-line flags (such as reverse shell indicators, downloads, or base64 decoding), potentially indicative of cloudpickle deserialization remote code execution (CVE-2026-49950).
Microsoft Sentinel (KQL)
