{"id":52552,"date":"2026-11-11T01:26:59","date_gmt":"2026-11-10T18:26:59","guid":{"rendered":"https:\/\/deepquest.code511.com\/blog\/?p=52552"},"modified":"2026-11-11T01:26:59","modified_gmt":"2026-11-10T18:26:59","slug":"cve-2026-65400-mac-check","status":"publish","type":"post","link":"https:\/\/deepquest.code511.com\/blog\/2026\/11\/cve-2026-65400-mac-check\/","title":{"rendered":"CVE-2026-65400 Mac check"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Detect and clean the macOS&nbsp;<strong>Screen Sharing \u2192 root \u2192 XMRig miner<\/strong>&nbsp;campaign that exploits&nbsp;<strong>CVE-2026-65400<\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In October 2026 automated scanners logged in to Screen Sharing\u00a0<strong>as root with no password<\/strong>\u00a0(the CVE-2026-65400 authentication bypass), planted backdoors and tried to install a Monero miner. It is a mass, automated campaign: if your Mac was unpatched and Screen Sharing or Remote Management could be reached from the internet, please check it.<\/p>\n\n\n\n<!--more-->\n\n\n\n<h2 class=\"wp-block-heading\">Am I at risk?<a href=\"https:\/\/github.com\/mrraylau321\/cve-2026-65400-mac-check#am-i-at-risk\"><\/a><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">You are at risk if&nbsp;<strong>all three<\/strong>&nbsp;are true:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>macOS is older than\u00a0<strong>Tahoe 26.6.1 \/ Sequoia 15.7.9 \/ Sonoma 14.8.9<\/strong>\u00a0(where Apple fixed it), and<\/li>\n\n\n\n<li><strong>Screen Sharing<\/strong>\u00a0or\u00a0<strong>Remote Management<\/strong>\u00a0is on (System Settings \u2192 General \u2192 Sharing), and<\/li>\n\n\n\n<li>port\u00a0<strong>5900<\/strong>\u00a0or\u00a0<strong>3283<\/strong>\u00a0is reachable from the internet (router port forward, UPnP, DMZ, or a public IP).<\/li>\n<\/ol>\n\n\n\n<pre class=\"wp-block-code\"><code>git clone <a href=\"https:\/\/github.com\/mrraylau321\/cve-2026-65400-mac-check.git\">https:\/\/github.com\/mrraylau321\/cve-2026-65400-mac-check.git<\/a><br>cd cve-2026-65400-mac-check<br>sudo bash detect.sh # read-only: changes nothing<br>sudo bash detect.sh --keys # read-only: lists every SSH key that can log in to this Mac<br>sudo bash cleanup.sh # dry run: lists what it would remove<br>sudo bash cleanup.sh --apply # cleans: moves files to a root-only quarantine folder, deletes nothing<br>sudo bash detect.sh # check again<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">source: <a href=\"https:\/\/github.com\/mrraylau321\/cve-2026-65400-mac-check\">https:\/\/github.com\/mrraylau321\/cve-2026-65400-mac-check<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Detect and clean the macOS&nbsp;Screen Sharing \u2192 root \u2192 XMRig miner&nbsp;campaign that exploits&nbsp;CVE-2026-65400. In October 2026 automated scanners logged in to Screen Sharing\u00a0as root with no password\u00a0(the CVE-2026-65400 authentication bypass),&#8230;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_hide_featured_image":false,"_jetpack_featured_image_duplicate_dismissed":0,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[108,4,8],"tags":[],"class_list":["post-52552","post","type-post","status-publish","format-standard","hentry","category-android-2","category-apple","category-osx-security-tools"],"jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p4bBYZ-dFC","jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/posts\/52552","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/comments?post=52552"}],"version-history":[{"count":1,"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/posts\/52552\/revisions"}],"predecessor-version":[{"id":52554,"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/posts\/52552\/revisions\/52554"}],"wp:attachment":[{"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/media?parent=52552"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/categories?post=52552"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/tags?post=52552"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}