A Mac Security Hole Is Letting Hackers Take Over Computers — Here's What to Do

A security flaw in Apple's Mac Screen Sharing feature is being actively used by hackers, with confirmed incidents in the Netherlands where attackers took full control of computers and installed hidden cryptocurrency mining software. The Netherlands National Cyber Security Centrum (NCSC-NL) issued an alert on August 12, 2026, reporting that it had received notifications of the vulnerability being exploited on multiple systems. (NCSC-NL)

Screen Sharing is a built-in Mac feature that lets someone view and control a computer remotely. The flaw, known by its tracking number CVE-2026-65400, allowed an attacker on the same network to connect to Screen Sharing without a password. Once connected, the attacker could see the screen, open files, and do almost anything as if they were sitting in front of the machine. (Apple Support)

Apple fixed the problem with emergency updates released on August 6, 2026. The company issued macOS 26.6.1 for Tahoe, 15.7.9 for Sequoia, and 14.8.9 for Sonoma, all dated August 6. (TidBITS) The fixes came out about six days before the Dutch government confirmed that hackers were actively using the flaw, meaning the patches were available before the attacks were publicly known. (Engadget)

A U.S. cybersecurity agency called CISA later raised the severity rating of the flaw from 7.1 to 9.8 out of 10, placing it in the "critical" category. The original 7.1 score was already considered "high"; the revised 9.8 score puts it near the very top of the scale used to measure how dangerous software vulnerabilities are. (Tom's Hardware)

In every confirmed case, the attackers gained the highest level of access to the computer — called "root" access — and installed software that mines Monero, a type of cryptocurrency. (Engadget) Cryptocurrency mining uses a computer's processing power to generate digital coins. Attackers do this on other people's machines to earn money without paying for the electricity or hardware themselves. Monero is popular for this kind of attack because it is designed to be difficult to trace. Mac computers, which are often left running for long periods, make attractive targets.

The vulnerability only affects computers where Screen Sharing is turned on and reachable from the internet. Security experts recommend keeping that connection closed and, if you don't need Screen Sharing, turning it off entirely in the Mac's System Settings. (Engadget)

For anyone managing Macs, the steps are simple: install the relevant macOS update, make sure Screen Sharing is not exposed to the outside internet, and turn off Screen Sharing if it isn't needed. Apple's decision to patch three different versions of macOS, including an older release called Sonoma, tells us the company considered this a serious risk worth the extra effort.

Around the same time, a separate but unrelated flaw was found in Zoom, the video conferencing app, where a bug allowed people on a call to take over other participants' devices. Zoom has released a fix. (Engadget) The fact that two different screen-sharing flaws appeared in the same period is something security teams should keep in mind when choosing remote-access tools, though the two vulnerabilities are not connected.

The timeline matters. Apple shipped the fix on August 6. The Dutch government confirmed active exploitation on August 12. CISA raised the severity rating on August 14. The gap between the patch being available and the attacks being confirmed could mean that people in the Netherlands were slow to install the update, or it could mean the attacks were happening before anyone publicly reported them. The available evidence does not tell us which.

The broader context is that remote-access features — tools designed to let you control a computer from afar — are inherently attractive to attackers because they provide exactly what a hacker wants: full control of a machine. When the password check can be skipped, the result is a computer that can be taken over remotely with no barrier at all. This is not unique to Apple; any remote-access tool that exposes this kind of connection carries a similar risk.

For Mac users and organizations, the action items are clear and immediate: update to the latest macOS version, check that Screen Sharing is not accessible from the outside, and turn off Screen Sharing on any computer where it isn't needed. The Dutch government's advisory and CISA's severity upgrade both make clear that this is not a theoretical risk. It is being used right now, and the mining software is already running on compromised machines.