Dutch Cybersecurity Alert: macOS Vulnerability Actively Exploited

The Netherlands National Cyber Security Centrum (NCSC) has issued a warning regarding a critical vulnerability in macOS that attackers are actively exploiting. This flaw, designated CVE-2026-65400, allows unauthorized users to execute malicious code on affected systems.

According to the NCSC, the exploitation has been observed on systems with port 5900 exposed to the internet, leading to unauthorized access and the installation of Monero crypto miners. This vulnerability, rated 7.1 out of 10 in severity, originates from a bug in macOS's screen sharing feature, which compromises state management and allows remote control of the device.

Apple addressed this issue with a patch released last week for macOS Tahoe, Sequoia, and Sonoma. Users are advised to disable screen sharing unless necessary and to ensure that the recent security update is installed. Currently, the only known exploit involves Monero miners, but the potential exists for more harmful malware to be utilized if the vulnerability remains unpatched.

Source: arstechnica.com