Apple macOS Screen Sharing Flaw Exploited on Internet-Exposed Macs to Install Monero Miner
- ID
- 14784
- Status
- summarized
- Published
- 15 Aug 2026, 3:24 PM
- Fetched
- 18 Aug 2026, 3:09 AM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/08/apple-macos-screen-sharing-flaw.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 5.5
- Created
- 18 Aug 2026, 3:11 AM
- Tags
- Audience
- developersvibe_coders
What happened
A critical macOS Screen Sharing flaw (CVE-2026-65400, CVSS 9.8) allowed attackers to authenticate to the built-in remote desktop service without valid credentials. The Netherlands NCSC reports active exploitation on Macs with port 5900 exposed to the internet, where attackers gained root access and installed Monero miners. Apple patched this in emergency updates for macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9 on August 6, 2026, alongside related Screen Sharing Server bugs CVE-2026-43779, CVE-2026-43777, and CVE-2026-43760.
Why it matters
If you run any Mac with Screen Sharing or Remote Management enabled and port 5900 reachable from the internet—common in homelab setups, remote dev machines, or CI runners—patch immediately and close port 5900. The exploit gives root without credentials, so exposure is effectively a full compromise, not just a mining nuisance.
Discussion angle
How many in the community expose Screen Sharing or VNC on Macs for remote development, and whether cloud-based dev environments or Tailscale-style overlays are a better default than opening port 5900.