Apples repair the macOS loophole to prevent the exploitation of Monroe coins

Apple has repaired a key MacOS screen sharing loophole, which was used by the attackers to obtain root access and install Monroe mining software. The Netherlands National Cyber Security Centre (NCSC) updated its warning on 12 August, confirming the active use of CVE-2026-65400 on multiple systems, in particular the equipment with port 5900 exposed to the Internet. The apples repaired the loophole in the MacOS update of 6 August, describing it as an identification defect that might allow the attackers to access screen sharing without valid proof. The security firm Huntress found that the defect affected the secure remote password authentication process shared on the MacOS screen and that the assailant could consider an uncertified connection. According to Ryan Dowd, a Huntress researcher, Censys has identified “tens of thousands of potential vulnerable hosts” and the risk of this loophole is particularly related to the hosting of naked metal Mac. The loophole was rated as a serious CVSS rating of 9.8 in the CISA gap analysis, without privileges or user interaction。