Active Exploitation of macOS Screen Sharing Flaw Leads to Monero Miner Infections
The Netherlands National Cyber Security Centre (NCSC) confirmed active exploitation of CVE-2026-65400, a high-severity vulnerability in macOS screen sharing that allows attackers to gain root access without credentials. Apple patched the flaw on August 6, 2026, for macOS Tahoe, Sequoia, and Sonoma. Attackers are currently deploying Monero cryptocurrency miners on affected systems. Users are advised to update their systems immediately or disable screen sharing if updates are not yet possible.