Dutch cyber-security officials say attackers are actively exploiting a high-severity macOS flaw that can let unauthenticated users gain control of affected Macs. The issue is particularly serious where Screen Sharing is enabled and port 5900 is exposed to the internet, as attackers have already obtained root access and installed cryptocurrency-mining software.

Apple patched CVE-2026-65400 last week for macOS Tahoe, Sequoia and Sonoma; it has a severity score of 7.1 out of 10 and stems from faulty Screen Sharing state management. Reported attacks have installed Monero miners so far, but the same access could potentially be used for credential theft or other malware; users are advised to install updates and disable Screen Sharing when not needed.