Apple Screen Sharing exploit found in the wild as macOS security updates arrive

The Netherlands National Cyber Security Centrum (NCSC) said it received notifications of the vulnerability being used on "multiple systems," and in all cases attackers gained root access and uploaded cryptocurrency mining software, according to Engadget. A proof-of-concept for the flaw, tracked as CVE-2026-65400, was posted on X by security researcher Calif (@calif_io), demonstrating that any network attacker can log in as any account if Screen Sharing is enabled.

Apple had already issued patches for the affected macOS versions, and on Monday it released macOS 26.6.2 along with Release Candidates for macOS Tahoe 26.7 and macOS Sequoia 15.8. Last week, Apple had shipped macOS 26.6.1, macOS Sequoia 15.7.9 and macOS Sonoma 14.8.9 specifically to fix the Screen Sharing bug. The release notes for the new versions say they provide security fixes and are recommended for all users, according to 9to5Mac. Users can also block Screen Sharing entirely in System Settings and should keep port 5900 closed, since the vulnerability is being exploited when that port is exposed to the internet. Engadget noted that Zoom recently patched a similar screen-sharing issue.

Separately, Apple on Monday released iOS 27 beta 6 and macOS 27 Golden Gate beta 6 to developers, according to 9to5Mac. iOS 27 is a major AI-focused update that introduces Siri AI, a rebuilt assistant powered by new Apple Foundation Models, plus Visual Intelligence, a dedicated Siri app, and refinements to the Liquid Glass design. Beta 6 resolves a Pinned Messages interface bug and arrives one week after beta 5, likely indicating fewer visual changes and more under-the-hood improvements before the September public release. macOS 27 Golden Gate brings a dedicated Siri app, unified window corner radii, AI-powered features in Shortcuts and Safari, and a pull-to-refresh gesture in Safari.

In another app update, Sonos added support for Apple's Live Activities on the iPhone lock screen, providing quick playback controls without fully unlocking the phone. Sonos called it a "much requested, anticipated and needed" feature, according to The Verge and Engadget. The control is off by default and can be enabled in both the Sonos app preferences and iOS settings. It shows the room or group name and the title of what's playing, but does not display album art. On Apple Watch and CarPlay, the Live Activity appears but controls are not yet supported. Sonos previously offered lock-screen controls from 2016 until 2023, when they were removed because the integration didn't align with Apple's updated design framework. After Sonos's troubled 2024 app redesign and subsequent restoration work, the company has now brought them back, according to Engadget.