Macs have a reputation for being untouchable. People assume there are no viruses, no hackers, and nothing bad ever happens to them. That reputation is wrong, and this month is a good example of why.
Apple released an emergency update on August 6 for macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9. The patch fixed exactly one problem: a Screen Sharing vulnerability tracked as CVE-2026-65400.
What the bug actually does
When you enable Screen Sharing, your Mac opens port 5900 to the network. That is how the feature is designed to work. It is what lets another person view and control your screen from a different machine. The design is fine. The implementation was not.
Apple got the authentication check wrong. An attacker on the same network could connect to your Mac with no password at all. No credentials, no prompt, just a connection. And the connection was not limited to looking at your screen.
The Dutch National Cyber Security Centre (NCSC-NL) confirmed on August 12 that attackers are actively exploiting this flaw. In every case the centre examined, the attacker reached root access, the highest level of control on a Mac, and then installed a Monero cryptocurrency miner. Your Mac turns into someone else’s mining rig. They burn your CPU, your electricity, and your bandwidth. You get a slower computer and a higher power bill.
I should have said this earlier: Screen Sharing is disabled by default on a fresh Mac. If you have never switched it on, you are most likely safe. But if you have ever used it for remote work, tech support, or just to experiment, it may still be running. One researcher found roughly 40,000 Macs with Screen Sharing enabled and reachable from the public internet. That is a large pool of targets for a bug that needs no password.
The part that should worry people is how basic the bug is. Researchers built a working proof of concept in a few hours, with AI assistance. The severity score was raised from 7.1 to 9.8 out of 10, which is critical, because the attack needs no user interaction, no password, and nothing else. An open port is enough.
So what do you actually do about it?
Two steps. One takes about five minutes, and the other takes ten seconds.
Update first. Open System Settings, go to General, then Software Update. Make sure you are on Tahoe 26.6.1, Sequoia 15.7.9, or Sonoma 14.8.9, or something newer. If you are not, install the update now.
Turn Screen Sharing off if you do not need it. Go to System Settings, then General, then Sharing, and flip the toggle. That is the whole step. Do this even after you update. A feature you turned on once for a single afternoon does not need to keep listening on a network port for the next three years.
If you are the kind of person who delays Apple updates until the weekend, that instinct is understandable. I ended up writing about why the 26.6.1 release was worth acting on quickly, and this Mac case is the same idea with a different operating system.
There is no clever middle ground here, because the bug does not ask for permission and does not need a password. Either the door is closed or it is not.
If you want to know whether you were already hit, the most obvious sign of a mining infection is a Mac that suddenly runs hot and loud while it is sitting idle. Open Activity Monitor, sort by CPU, and check whether anything unfamiliar is pinned at the top with no clear reason. That is not proof of an infection, but it is the cheapest check you can run, and it takes less time than reading this paragraph.
Exposure is not limited to machines facing the open internet. The bug also works from the same local network, which means a compromised laptop on your coffee-shop Wi-Fi is a real threat, not just a server with a public IP. Turning Screen Sharing off shuts both doors at the same time, and that is why it is the better habit to keep.
I am not certain how many people this will actually affect. Most casual users never enable Screen Sharing. But if you are a developer, if you manage remote Macs, or if you have ever let a friend log in to help you fix something, you should check. The people at risk are exactly the people who set this up for a legitimate reason and then forgot about it.
I will be frank about my own history. I turned Screen Sharing on once, years ago, so a colleague could help me debug a problem. Then I forgot it existed. It was probably running for months. That is the trap with these features. You enable them for one specific task, and they sit there quietly, waiting for the next person who finds the open port.
When I checked just now, mine was off. Yours might not be.
One more detail worth knowing: this is not the only Screen Sharing bug Apple fixed recently. There is a second one, CVE-2026-43760, but that flaw requires the attacker to already have a VNC password. The bug everyone is talking about needs nothing at all. The distance between “needs a password” and “needs nothing” is the entire difference between a quiet patch note and a front-page headline.
The affected builds are specific. Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9 are the patched releases, and anything older than those is vulnerable. If you run an older macOS version that no longer receives these updates, the safest move is to disable Screen Sharing entirely, because no fix is coming for your system. Organizations with Mac fleets should treat this as a managed rollout rather than waiting for each employee to notice the prompt on their own.
I am not writing this to scare anyone. I use a Mac every day, and I assume most of you do too. Updates are annoying. They interrupt your work. But this particular update takes five minutes, and the cost of skipping it is a computer that someone else is using for free.
Just install it, and turn the feature off if you do not use it.
I will keep watching this story and post an update here if anything changes.
