NCSC-NL first flagged the vulnerability in an advisory on August 7, a day after Apple's patch, urging organizations to update immediately. The August 12 revision added that public proof-of-concept code is now available and that active abuse had been observed on multiple internet-exposed systems.
Technical details of the bug were presented at last week's Black Hat conference, according to Ars Technica , alongside a video of the exploit in action. The root-level access attackers gained in the reported incidents matches the level of control researchers demonstrated in May, when they bypassed Memory Integrity Enforcement on Apple's M5 silicon with AI assistance.
NVD's change log for CVE-2026-65400 shows CISA initially scored the bug at 7.1 on August 6, using a vector that assumed an attacker needed low-level privileges and could achieve only partial impact. On August 14, the agency replaced that vector with one requiring no privileges and granting full compromise of confidentiality, integrity, and availability, raising the score to 9.8. A day later, CISA's decision record for the flaw flipped from "not automatable" to automatable, an assessment consistent with unattended Macs being rooted at scale for coin mining.
The flaw still isn't in CISA's Known Exploited Vulnerabilities catalog as of this writing. The same decision record also still lists exploitation as "none," despite the NCSC-NL report. Users who can't update immediately can turn Screen Sharing off under System Settings > General > Sharing.
Wide-ranging 7-zip vulnerability with 8.8 CVE rating allows for code execution
Key considerations
- Investor positioning can change fast
- Volatility remains possible near catalysts
- Macro rates and liquidity can dominate flows
Reference reading
- https://www.tomshardware.com/tech-industry/cyber-security/SPONSORED_LINK_URL
- https://www.tomshardware.com/tech-industry/cyber-security/macos-screen-sharing-flaw-exploited-to-root-macs-and-plant-monero-miners#main
- https://www.tomshardware.com/membership
- Class Is in Session: GeForce NOW Levels Up Linux, Chromebooks and More
- Dell CEO unveils new 'Dude, you’re getting a Dell (AI server rack)' video — PC maker recycles famous PC ad campaign to tout its new AI data center products
- Industry Leaders Unite in Open Secure AI Alliance for AI Safety and Security
- AI Leaders Propose SAFE Guidelines for Cybersecurity Transparency
- Nvidia Jetson chip found in Russian cruise missile, Ukraine claims — presence in S-71 'Monochrome' weapon may indicate use of AI tech
Informational only. No financial advice. Do your own research.