[Hackers Exploit macOS Screen Sharing Vulnerability to Infiltrate Macs and Deploy Monero Mining Software] Deep Tide TechFlow reports that on August 17, according to Decrypt, the Netherlands National Cyber Security Centre (NCSC) issued a warning that attackers are actively exploiting an authentication vulnerability (CVE-2026-65400, severity score 7.1) in macOS's screen sharing feature. The attacks target Mac devices that expose port 5900 to the public internet. After successfully obtaining root privileges, attackers implant Monero mining software. The vulnerability stems from improper state management during the login process, allowing attackers to bypass authentication without valid credentials. Proof-of-concept code for this vulnerability has already circulated online, further lowering the barrier for exploitation. Apple has addressed this vulnerability in macOS Sequoia 15.7.9, Sonoma 14.8.9, and Tahoe 26.6.1. The NCSC advises users to install updates promptly and avoid exposing the screen sharing feature to the public internet.