VulnHub

Real-time Cybersecurity News

Critical

Attackers exploit patched macOS Screen Sharing flaw to deploy cryptominer

Help Net Security
Actively Exploited
macOSCVEAppleExploitVulnerabilityUpdate

Overview

Hackers are exploiting a recently patched vulnerability in macOS, known as CVE-2026-65400, which allows unauthorized access to the macOS Screen Sharing feature. This flaw enables attackers to bypass authentication and gain root access to affected systems, leading to the installation of cryptominers without user consent. The Netherlands’ National Cyber Security Centre has issued a warning about this active exploitation, emphasizing the need for users to update their systems. Apple has released patches for macOS Sequoia (15.7.9), Sonoma (14.8.9), and Tahoe (26.6.1) to address this issue, urging all macOS users to upgrade promptly to protect their devices. Failure to do so could leave systems vulnerable to further attacks and unauthorized resource usage.

Key Takeaways

  • Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
  • Affected Systems: macOS Sequoia (15.7.9), macOS Sonoma (14.8.9), macOS Tahoe (26.6.1), Apple macOS systems
  • Action Required: Users should upgrade their macOS systems to the latest versions: Sequoia (15.
  • Timeline: Newly disclosed

Original Article Summary

A recently patched security flaw in Apple macOS is being actively exploited by hackers to bypass authentication, gain root access, and install a cryptominer, the Netherlands’ National Cyber Security Centre (NCSC) warns. The vulnerability, tracked as CVE-2026-65400, , let attackers authenticate to macOS Screen Sharing without valid login credentials. Apple fixed the issue with updates to macOS Sequoia (15.7.9), Sonoma (14.8.9), and Tahoe (26.6.1), and advised its macOS users to upgrade their systems. “An authentication … More → The post Attackers exploit patched macOS Screen Sharing flaw to deploy cryptominer appeared first on Help Net Security.

Impact

macOS Sequoia (15.7.9), macOS Sonoma (14.8.9), macOS Tahoe (26.6.1), Apple macOS systems

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Newly disclosed

Remediation

Users should upgrade their macOS systems to the latest versions: Sequoia (15.7.9), Sonoma (14.8.9), and Tahoe (26.6.1) to patch the vulnerability.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to macOS, CVE, Apple, and 3 more.

Read Original Article

Related Coverage

Google Brings AirDrop Compatibility to Android’s Quick Share Using Rust-Hardened Security

The Hacker News

Google has updated its Quick Share service to enable compatibility with Apple's AirDrop, facilitating easier file sharing between Android and iPhone devices. This feature is currently available for the Pixel 10 lineup and is expected to expand to other devices in the future.

Nov 21, 2025

New FlexibleFerret Malware Chain Targets macOS With Go Backdoor

Infosecurity Magazine

The article discusses a new macOS malware chain attributed to FlexibleFerret, which employs staged scripts and a Go-based backdoor to steal user credentials and maintain persistent access to infected systems. This represents a significant cybersecurity threat to macOS users, emphasizing the need for heightened security measures against such sophisticated attacks.

Nov 25, 2025

DPRK's FlexibleFerret Tightens macOS Grip

darkreading

The DPRK's FlexibleFerret campaign is evolving its tactics to enhance its social engineering scams aimed at macOS users, indicating a sophisticated approach to credential theft. This ongoing threat underscores the need for heightened awareness and security measures among macOS users to protect against such attacks.

Nov 25, 2025

​​Spyware Allows Cyber Threat Actors to Target Users of Messaging Applications​

All CISA Advisories

CISA has identified that various cyber threat actors are using commercial spyware to target users of mobile messaging applications, employing tactics such as phishing, zero-click exploits, and impersonation. The focus is primarily on high-value individuals including government and military officials, indicating a serious threat to sensitive communications.

Nov 24, 2025

IT threat evolution in Q3 2025. Non-mobile statistics

Securelist

The report highlights the evolving landscape of IT threats in Q3 2025, focusing on malware targeting Windows and macOS personal computers, as well as IoT devices. This indicates a growing severity of cyber threats that could have significant implications for users and organizations relying on these systems.

Nov 19, 2025

India Rolls Back App Mandate Amid Surveillance Concerns

darkreading

India has decided to roll back its mandate requiring citizens to install a cybersecurity app designed to enhance surveillance and security. The app, intended to monitor digital activities, faced backlash over privacy concerns, with citizens worried about excessive government monitoring and data collection. The government's initial push for this app was met with skepticism, drawing comparisons to Apple's controversial decision to distribute a U2 album to all iTunes users. By reversing this mandate, India acknowledges the public's apprehension regarding personal privacy and the implications of government surveillance. This situation underscores the delicate balance between national security and individual privacy rights, a conversation that continues to evolve in the digital age.

Dec 5, 2025