macOS Screen Sharing Flaw Gives Remote Attackers Root in 60 Seconds
A pre‑authentication bug in screensharingd (macOS 26.5 and earlier) lets any network attacker send an oversized frame and trigger a stale success check, dropping a root shell in under a minute without passwords. Apple patched it in macOS 26.6, but unpatched machines expose full disk contents and allow arbitrary file writes as root.