Apple and a Hacker's Future
Attackers are exploiting macOS screen-sharing flaw CVE-2026-65400 on exposed port 5900 to install Monero miners.
The Netherlands NCSC warned that CVE-2026-65400, a macOS screen-sharing state-management flaw scored 7.1, is under active exploitation on systems with port 5900 exposed to the internet, where attackers gained root and installed a Monero miner. Apple patched macOS Tahoe, Sequoia, and Sonoma last week, credited Bynario, and details were presented at Black Hat. In a Stratechery essay, Ben Thompson says the bug hit his always-on Mac Mini running only Claude and Codex, and a persistent Claude agent flagged passwordless administrator access before he wiped the machine. He also criticizes Apple's plan to require more explicit user consent for Full Disk Access as AI agents become more autonomous.
- CVE-2026-65400 is a macOS screen-sharing bug rated 7.1.
- Dutch NCSC saw active exploitation, root access, and Monero miners.
- Apple patched Tahoe, Sequoia, and Sonoma after Bynario's report.
- A Claude agent on the author's Mac Mini flagged the compromise.
- Apple will require more explicit consent for Full Disk Access.
- CVEs
- CVE-2026-65400
- Vendors
- Apple
- Organizations
- Dutch NCSCBynarioAnthropicOpenAI
- Countries
- Netherlands
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-65400 | Authentication Bypass in Apple macOS Screen Sharing | 9.8 | 2% | KEV | KEV |
From the original article
14 min read at stratechery.com
My computer got hacked; the vulnerability that was exploited is detailed in this Ars Technica story : Dutch officials have warned that a high-severity macOS vulnerability that allows attackers to execute malicious code is under active exploitation.
By maguay · stratechery.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.