Apple patches macOS flaw exploited to mine Monero

Apple has patched a critical macOS Screen Sharing vulnerability after attackers exploited internet-facing Macs to gain root access and install Monero mining software, according to an updated warning from the Netherlands’ National Cyber Security Centre. Summary Apple patched CVE-2026-65400 after attackers exploited Mac Screen Sharing services to install Monero miners remotely. Dutch cybersecurity officials confirmed compromised Macs had root access and unauthorized Monero mining software installed. CISA now scores the authentication flaw 9.8 critical, up from its earlier 7.1 assessment overall. Huntress found tens of thousands of potentially exposed Macs, especially internet-hosted bare-metal Apple systems worldwide. Changing Screen Sharing passwords cannot fix the flaw; affected Macs require Apple security updates immediately. The Dutch NCSC updated its advisory on Aug. 12 to confirm active exploitation of CVE-2026-65400 on multiple systems with port 5900 exposed to the internet. In every reported case, attackers obtained root access and installed a Monero miner. The agency did not disclose how many Macs were compromised or identify the attackers. Apple Screen Sharing flaw bypasses...