Software vulnerabilities enabling root access

Security researchers have identified critical vulnerabilities in widely used software that allow for privilege escalation and unauthorized system control.

In September 2026, a flaw in Parallels Desktop for Mac, designated as CVE-2026-90894 and nicknamed ‘ParaShells’, was discovered. This argument-injection bug allows local users on Apple silicon machines to escalate privileges to full root control. The vulnerability is noted as particularly risky for shared workstations and developer machines, where attackers could use entry points like malicious npm scripts to seize complete system control.

In October 2026, researchers released ‘AnyPwn’, an exploit targeting a pre-authentication remote code execution flaw in AnyDesk for Linux. The vulnerability involves a heap buffer overflow in the software’s session protocol, enabling attackers to gain root access via direct TCP connections on port 7070. While AnyDesk addressed the issue in version 8.0.3, the company’s initial changelog only noted a fix for a bug that could lead to a crash, without issuing a formal security advisory or assigning a CVE.