Active exploitation of macOS Screen Sharing (CVE‑2026‑65400) installs Monero miners
The Dutch NCSC saw attackers using CVE‑2026‑65400 to bypass authentication on macOS Screen Sharing when port 5900 is internet‑exposed, gaining root and deploying Monero mining software. The bug affects Sequoia 15.7.9, Sonoma 14.8.9 and Tahoe 26.6.1; Apple’s patches should be applied now.