{"id":2376,"date":"2026-08-17T16:53:59","date_gmt":"2026-08-17T16:53:59","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=2376"},"modified":"2026-08-17T16:53:59","modified_gmt":"2026-08-17T16:53:59","slug":"apple-macos-screen-sharing-flaw-exploited-on-internet-exposed-macs-to-install-monero-miner","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=2376","title":{"rendered":"Apple macOS Screen Sharing Flaw Exploited on Internet-Exposed Macs to Install Monero Miner"},"content":{"rendered":"
\n
<\/a><\/div>\n

A recently patched security flaw in Apple macOS has come under active exploitation in the wild to deploy a cryptocurrency miner, the Netherlands National Cyber Security Centre (NCSC) has warned<\/a>.<\/p>\n

The vulnerability in question is CVE-2026-65400<\/a><\/strong> (CVSS score: 9.8), a critical authentication issue impacting the Screen Sharing component that could allow an attacker already on the network to authenticate to the built-in remote desktop feature service without valid credentials.<\/p>\n

The updates released by Apple improve state management mechanisms to enforce correct credential validation and prevent unauthorized authentication attempts. The shortcoming was addressed as part of an emergency update in macOS Tahoe 26.6.1<\/a>, macOS Sequoia 15.7.9<\/a>, and macOS Sonoma 14.8.9<\/a> earlier this month.<\/p>\n

\u00abAn authentication issue was addressed with improved state management,\u00bb Apple said in an advisory released on August 6, 2026. It credited security researcher Alfredo Pesoli of Bynario for discovering and reporting the issue.<\/p>\n

In an update to its advisory, the NCSC-NL said it has received a report indicating active abuse of the vulnerability across multiple systems on which port 5900 was accessible from the internet.<\/p>\n

\u00abIn all these cases, root had gained access to the affected system and placed a Monero crypto miner,\u00bb the agency added.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

There are currently no details on when these attacks were observed, the scale of such efforts, if the flaw was exploited as a zero-day, and if it goes beyond cryptocurrency mining.<\/p>\n

<\/p>\n

Calif, which published additional information<\/a> about the flaw, said it’s part of a series of bugs in the Screen Sharing Server component that were patched by Apple with macOS Tahoe 26.6<\/a> shipped late last month –<\/p>\n