A few weeks back, Apple released several macOS security updates to address a serious vulnerability within its Screen Sharing tool. At the time, the bug hadn’t been spotted in the wild. It was more of a “better safe than sorry” type of thing. Now it’s actually been found wreaking havoc in the Netherlands, according to a report by Ars Technica.
The vulnerability lets an attacker view a user’s screen, open up files and do just about anything else they want on the victim’s computer. It’s as if they had physical possession of the machine.
Dutch officials with the Netherlands National Cyber Security Centrum have issued a warning and noted that they received notifications of the vulnerability being used on “multiple systems.” In all cases, the attackers received root access and uploaded crypto mining software.
PoC for a critical vulnerability in Apple macOS Screen Sharing (CVE-2026-65400).
If Screen Sharing is enabled, any network attacker can exploit the bug to log in as any account, without knowing the password.
We reverse engineered Apple’s unusual macOS 26.6.1 patch to understand… pic.twitter.com/WRIIwKx6yI
— Calif (@calif_io) August 8, 2026
As previously mentioned, Apple has already issued software fixes. A software update was recommended back when this vulnerability was, more or less, theoretical. Now it’s an absolute necessity. The bug impacts Tahoe, Sequoia and Sonoma, and there are new versions of all three.
There are other things worth doing to prevent this kind of attack. It’s possible to block Apple’s Screen Sharing tool altogether, which is an option in the System Settings menu. That’ll do the trick. Also, the vulnerability is being exploited when port 5900 is exposed to the internet. Security experts recommend keeping that port closed, especially when sharing a screen.
This isn’t even the only big screen-sharing bug making the rounds in the past couple of weeks. Zoom experienced something similar and has also issued a patch. Stay safe out there.
Read the original article here