MITRE Caldera security suite scores perfect 10 for insecurity

The smart cookie who discovered a perfect 10-out-of-10-severity remote code execution (RCE) bug in MITRE's Caldera security training platform has urged users to "immediately pull down the latest version." As in, download it and install it. Tracked as CVE-2025-27364, the max-severity vulnerability affects all versions of Caldera, including the very first ones released back in 2017, bar the latest fixed versions: 5.1.0+, or whatever's in the master source branch. Caldera began as a research project in 2015 before launching as a fully fledged adversary emulation platform. Today, the open source project is relied upon by red and blue teams to simulate attacks and breaches, and develop organizational defenses. In reality, the suite itself can be remotely hijacked. To make matters worse, the RCE flaw can be triggered "in most default configurations," according to Dawid Kulikowski, who found and reported the hole. An attacker can only achieve RCE when Go, Python, and the GNU Compiler Collection (GCC) are installed on the target device, though all three dependencies are required for Caldera to be fully functional. Speaking of vulnerabilities, researcher Mickey Jin has published two privilege-escalation exploits that can be used against Parallels Desktop for Mac to gain local root access. CVE-2024-34331 was disclosed and "patched" by Parallels in May 2024. Since then, using various versions, Jin has found ways of bypassing the vendor's fixes. It's worth reading his write-up to fully u...