If you’ve been putting off that macOS update sitting in your notifications, this is the week to stop and install it.
Apple quietly patched a serious screen sharing flaw in macOS earlier this month. While that usually means the issue is resolved, new evidence shows hackers already broke into unpatched Macs, hijacked them, and used them for cryptocurrency mining before the fix shipped.
So what exactly went wrong with screen sharing?
The flaw lets bad actors access macOS screen sharing without the system’s valid login credentials. Once in, they could view a victim’s desktop and take control of the mouse and keyboard (remotely) without warning whoever was actually sitting at the machine.
Once attackers get root access, they reportedly install Monero crypto miners onto every compromised Mac spotted so far, quietly burning through users’ CPU cycles and electricity in the background; hackers value that over the local files.
Apple patched the issue on August 6 with macOS Tahoe 26.6.1, describing it as improved state management for the authentication process, along with matching updates for Sonoma and Sequoia.
What happens on a hacked Mac, and how do you stay safe?
However, the Netherlands’ National Cyber Security Center says it has since tracked real-world abuse of that bug on machines running unpatched or older macOS versions, where port 5900 (which screen sharing uses) was left accessible from the open internet.
Port 5900 has been a known soft spot in remote access tools for years. Apple’s macOS automatically opens that port the moment you enable screen sharing, with no separate warning that it’s now reachable from outside your network.
Because the bug bypasses authentication entirely, scanning bots can automatically gain root-level control of exposed machines and install a cryptocurrency miner. If your Mac relies on screen sharing over an open network connection, act immediately.
I’d recommend installing the latest macOS version immediately. Head to System Settings > General > Software Update, and install the update. If updating immediately isn’t an option, your safest short-term move is to disable the feature altogether by going to System Settings > General > Sharing and toggling screen sharing off.
