The Dutch National Cyber Security Center warned of active exploitation of a macOS Screen Sharing vulnerability across systems with port 5900 exposed to the internet. Attackers gained root access and installed Monero mining programs on compromised machines. Tracked as CVE-2026-65400 with a severity rating of 7.1 out of 10, the flaw stems from faulty state management during the authentication process, allowing attackers to bypass valid credentials. Apple patched the issue in macOS Sequoia 15.7.9, Sonoma 14.8.9, and Tahoe 26.6.1. Users who have not updated, particularly those with Screen Sharing reachable from the open internet, remain exposed.
Source: Read the original article
