A release candidate (RC) is a pre-release build that is close to final and is intended to expose bugs, regressions, and compatibility problems before software ships. RCs are usually feature-complete, so the focus shifts from adding functionality to stabilizing code, fixing defects, and verifying that recent changes did not break older behavior.
In cyber security, RCs matter because security-critical software such as operating systems, browsers, VPNs, and firmware can introduce new vulnerabilities or operational regressions during late-stage changes. Defenders often test RCs in staging environments to catch crashes, privilege issues, logging failures, or broken controls before production rollout. Attackers may also study RCs to find newly introduced flaws before patches are finalized. For that reason, RC builds should be treated as test material, not trusted production software.