Reported by 1 outlet
No Country for Old Passwords
Why this score
- Breadth
- 0.50 / 2.0 · 1 source
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 5.00 / 5.0 · CVSS + KEV signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
No Country for Old Passwords
malware.news · 64d ago · August 10th, 2026
On Thursday August 6, Apple shipped an emergency macOS update . It fixed exactly one vulnerability, CVE-2026-65400, in a feature called Screen Sharing . Apple does not ship an update out of band unless something is critical. That piqued our curiosity. We started reverse engineering the emergency update and had a working exploit for the bug they fixed about four hours later: Screen Sharing lets somebody at another computer connect to your Mac, see your screen, and use your computer as though they were sitting at your desk. It is a normal, useful feature that allows you to run a Mac mini in a closet, or fix a Macbook in another building. The researcher who started all this found around 40,000 Macs with Screen Sharing reachable from the Internet. Signing in takes an account name and password. If a Mac has not taken Thursday's update, anyone who can reach it over the network can skip the password and sign in as you. That kind of bug is called pre-auth, and it's what Apple rushed to fix. We thought that would be the end of the story, but it got more interesting. We had not fully appreciated the impact. screensharingd , the program answering those connections, runs as root , the account that can do anything, so an attacker did not stop at your account. They could breach every other account on the machine and install whatever they wanted. That makes this, as far as we can tell, the first public macOS remote root exploit in a long time. Then we learned that it was only the se