CRITICALVulnerability
Global

Apple macOS Screen Sharing Flaw Exploited on Internet-Exposed Macs to Install Monero Miner

·Source: The Hacker News

Updated:

Executive Summary

A recently patched security flaw in Apple macOS has come under active exploitation in the wild to deploy a cryptocurrency miner, the Netherlands National Cyber Security Centre (NCSC) has warned. The vulnerability in question is CVE-2026-65400 (CVSS score: 9.8), a critical authentication issue impacting the Screen Sharing component that could allow an attacker already on the network to

Analysis

A recently patched security flaw in Apple macOS has come under active exploitation in the wild to deploy a cryptocurrency miner, the Netherlands National Cyber Security Centre (NCSC) has warned. The vulnerability in question is CVE-2026-65400 (CVSS score: 9.8), a critical authentication issue impacting the Screen Sharing component that could allow an attacker already on the network to

Indicators of Compromise (1)

CVE (1)
CVE-2026-65400
NVDMITRE CVE
Source Attribution

Originally published by The Hacker News on Aug 15, 2026.

Related Threats

MEDIUMVulnerabilityNEW

Revolut to open network of airport lounges across Europe

Revolut has unveiled plans for a network of premium branded airport lounges across major European destinations.

Finextra
CRITICALVulnerability

NVD CRITICAL: CVE-2026-74889 — openssl_encrypt versions before 1.4.0 use HKDF with no salt and static info para...

openssl_encrypt versions before 1.4.0 use HKDF with no salt and static info parameter in key normalization functions, reducing entropy extraction and determinism. Attackers can exploit predictable key derivation with identical inputs to weaken cryptographic security against multi-target attacks.

CVE-2026-74889
NIST NVD
CRITICALVulnerability

NVD CRITICAL: CVE-2026-74886 — openssl_encrypt versions before 1.4.0 contain a plugin sandbox bypass vulnerabil...

openssl_encrypt versions before 1.4.0 contain a plugin sandbox bypass vulnerability where the PluginImportGuard blocks a different set of modules than the AST analyzer's DANGEROUS_MODULES set. Attackers can bypass AST analysis through string obfuscation or encoding to import unblocked dangerous modules like sys, shutil, multiprocessing, importlib, and pickle for arbitrary code execution.

CVE-2026-74886
NIST NVD