Apple patches macOS flaw exploited to mine Monero
Apple has patched a critical macOS Screen Sharing vulnerability after attackers exploited internet-facing Macs to gain root access and install Monero mining software, according to an updated warning from the Netherlands National Cyber Security Centre. The Dutch NCSC updated its advisory on Aug. 12 to confirm active exploitation of CVE-2026-65400 on multiple systems with port 5900 exposed to the internet. In every reported case, attackers obtained root access and installed a Monero miner. The agency did not disclose how many Macs were compromised or identify the attackers. Apple Screen Sharing flaw bypasses authentication Apple patched CVE-2026-65400 on Aug. 6 in macOS Tahoe 26.6.1, Sequoia 15.7.9 and Sonoma 14.8.9. The company described it as an authentication flaw caused by improper state management that could allow an attacker on the network to access Screen Sharing without valid credentials. Security firm Huntress found that the flaw affects the Secure Remote Password authentication process used by macOS Screen Sharing. Its analysis showed an attacker could cause the service to treat an unauthenticated connection as authenticated and obtain privileged access. Because exploitation occurs before normal authentication, Huntress said changing a Screen Sharing password, disabling legacy VNC authentication or removing authorized user accounts does not address the vulnerability. The recommended fix









