Apple urgently fixes macOS screen sharing vulnerability, exposing that Macs have been used for cryptocurrency mining

According to The Hacker News, the Netherlands National Cyber Security Centre (NCSC) has warned that a recently patched severe authentication vulnerability (CVE-2026-65400, CVSS score 9.8) in Apple's macOS screen sharing component has been exploited in the wild, allowing attackers to access Macs exposed to the internet (port 5900) and implant Monero mining software without valid credentials.

Apple has fixed the vulnerability with an emergency update on August 6, alongside macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9, by enhancing credential verification through improved state management. The NCSC confirmed that in multiple attacks, the attackers gained root access and deployed mining software. Security researcher @osxreverser disclosed another pre-authentication vulnerability in the same component (also patched in 26.6), which allows bypassing password authentication with just the target IP, without needing a username.

According to Calif, researchers developed usable attack programs for both vulnerabilities using AI in just 4 hours, demonstrating that AI is significantly shortening the time from vulnerability discovery to the development of attack code. Users are advised to update their systems immediately; if unable to update, they should disable the screen sharing feature.