Dutch officers have warned {that a} high-severity macOS vulnerability that enables attackers to execute malicious code is beneath energetic exploitation.
“The NCSC has obtained a notification indicating that energetic abuse of this vulnerability has been noticed on a number of techniques on which port 5900 was accessible from the Web,” the Netherlands Nationwide Cyber Safety Centrum warned earlier this week. “In all these circumstances, root had been accessed on the affected system and a Monero crypto miner had been positioned.”
Are you aware in case your display screen sharing is on?
The vulnerability, tracked as CVE-2026-65400, obtained a patch from Apple final week for macOS Tahoe, Sequoia, and Sonoma. The vulnerability, with a severity ranking of seven.1 out of 10, stems from a bug within the macOS display screen sharing functionality, which permits a distant get together to view the display screen and management the keyboard and mouse whereas a machine is turned on. A flaw within the “state administration,” which retains observe of previous occasions, consumer interactions, variables, and different system states, is the underlying trigger.
A video of the exploit in motion might be discovered right here. Particulars of CVE-2026-65400 turned public finally week’s Black Hat safety convention. Apple stated final week that CVE-2026-65400 “could” permit an attacker with out credentials to achieve entry to a Mac. It’s unclear why Apple hedged, however softening language is widespread amongst most tech builders when disclosing vulnerabilities.
