The Mac setting you turned on once, and should probably turn off

The Netherlands' national cyber security centre issued a warning this week that a macOS vulnerability is being actively exploited in the wild. Not theoretically. Observed, on multiple machines, with attackers gaining root access and quietly installing Monero crypto miners.

The flaw is CVE-2026-65400, rated 7.1, and it sits in macOS's screen sharing feature - the built-in tool that lets someone view your screen and drive your keyboard and mouse remotely. A state management bug means a remote party can get in without credentials. Apple patched it last week for Tahoe, Sequoia and Sonoma, and credited the security firm Bynario for finding it. Details went public at Black Hat.

Every observed case had one thing in common: **port 5900 was reachable from the internet.**

## Why that detail is the whole story

Screen sharing is off by default on a Mac. When you switch it on, macOS opens port 5900 in its firewall. Most routers won't forward that port to the outside world unless someone has deliberately configured them to - so the machines being compromised are, almost without exception, ones where somebody turned screen sharing on and something in the network was set up to let the world reach it.

That is a very familiar shape. An IT person or a supplier needed remote access once, to fix something. It got enabled. It worked. Nobody turned it off, because nothing appeared to be wrong. Two years later it's still on, on a machine sitting in the back office running the accounts.

The patch closes this particular hole. It does nothing about the next one, on a machine that's still listening to the entire internet.

## What to actually do

**Install the update.** Apple menu → System Settings → General → Software Update. That closes CVE-2026-65400 specifically, and it's the five-minute job.

**Then check whether screen sharing should be on at all.** System Settings → General → Sharing, and look at the Screen Sharing toggle. If you don't know why it's on, that is itself the answer. Turn it off, and switch it on only for the length of a support session.

**If you genuinely need remote access**, don't expose it directly. The standard advice is to reach the machine over a VPN or an SSH tunnel rather than opening the port to the world. That's more setup than most small businesses will want to do alone, which is a fair reason to ask someone - but it is not a reason to leave the port open in the meantime.

## The broader habit

The interesting thing about this one isn't the vulnerability. Vulnerabilities are constant, and Apple patched this within about a week of disclosure. The interesting thing is that exploitation required a second, entirely human ingredient: a convenience feature left switched on long after the convenience had passed.

Worth asking, once a year, of every machine in the business: what is this thing allowed to talk to, and does it still need to be? Most small businesses have never asked. It takes an afternoon, and it's the sort of question that turns a headline into something that simply doesn't apply to you.