macOS Screen Sharing Flaw Exploited for Root Access and Monero Mining
Dutch authorities report active attacks on internet-exposed Macs via CVE-2026-65400. CISA has raised the bug's severity to a critical 9.8.
AfroEuropa Newsroom
AfroEuropa desk
The Netherlands' National Cyber Security Centre (NCSC-NL) has warned that attackers are actively exploiting an authentication bypass in macOS Screen Sharing, tracked as CVE-2026-65400.
In an update issued on August 12, the agency said the flaw is being used to compromise Macs that have port 5900 exposed to the internet. According to the NCSC-NL, every incident reported to it involved attackers gaining root access and installing a Monero cryptocurrency miner, as reported by Tom's Hardware. BleepingComputer noted that the warning followed the emergence of public exploit code.
Apple addressed the vulnerability on August 6 in an out-of-band update covering macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9. The NCSC-NL first published an advisory on August 7, a day after the patch, urging organizations to update without delay. Its August 12 revision added that public proof-of-concept code was now available and that abuse had been seen on multiple internet-exposed systems.
Keep reading
Binance Hit by Record Crypto Heist, Freezes Withdrawals and Pledges to Cover Losses
Binance confirmed a major hack that drained billions in cryptocurrency. The exchange suspended withdrawals and said user funds remain safe as stablecoin issuers moved to freeze stolen assets.
Other highlights
WhatsApp Rolls Out Group Status and Message-Sharing Updates
The messaging app introduced Group Status updates visible only to group members, along with tools to share old messages with new members and pin messages.
Follow the story
One newsletter, two continents
The Bridge brings you the tech, startups, and leaders moving between Africa and Europe in one sharp email each morning. No spam, unsubscribe anytime.
