MacOS users warned to beware screen-sharing bug which can turn Macs into cryptomining slaves
Apple patched a critical-severity flaw in Screen Sharing which allowed crooks unabated access to vulnerable devices.
A critical vulnerability in macOS Screen Sharing, CVE-2026-65400, was publicly disclosed and quickly exploited for cryptojacking within days. This flaw allows attackers to bypass authentication and gain root access by exploiting an exposed port (5900) and deploying Monero miners using XMRig. Screen Sharing, a built-in macOS tool, enables remote device access, similar to tools like AnyDesk or TeamViewer.
Apple patched the issue in Sequoia 15.7.9, Sonoma 14.8.9, and Tahoe 26.6.1, but the vulnerability was already being leveraged in cyberattacks. The Netherlands' National Cyber Security Centrum (NCSC) reported active abuse of the vulnerability, stating that root access was gained and a Monero crypto miner was placed on affected systems.
To stay safe, users should install the patch released by Apple immediately and block Screen Sharing if not needed, as attackers could also exploit the flaw for data exfiltration, malware deployment, or ransomware attacks.
Written by urgent.news from TechRadar's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
