No Country for Old Passwords
Brief
On Thursday August 6, Apple shipped an emergency macOS update . It fixed exactly one vulnerability, CVE-2026-65400, in a feature called Screen Sharing .
Apple does not ship an update out of band unless something is critical. That piqued our curiosity. We started reverse engineering the emergency update and had a working exploit for the bug they fixed about four hours later:
Screen Sharing lets somebody at another computer connect to your Mac, see your screen, and use your computer as though they were sitting at your desk. It is a normal, useful feature that allows you to run a Mac mini in a closet, or fix a Macbook in another building. The researcher who started all this found around 40,000 Macs with Screen Sharing reachable from the Internet.
Signing in takes an account name and password.