As AI models gain advanced capabilities to find vulnerabilities in software, develop ways to exploit them, and even carry out autonomous hacking sprees, researchers offered a sobering new example on Tuesday, disclosing vulnerabilities in the video conferencing platform Zoom that could have been exploited to take over targets’ devices. Anyone on a call that involved screen sharing, whether participants or the host, would have been vulnerable to a silent attack that could be carried out with no indication and no interaction from the victim.
Researchers from the digital defense firm A Security say the bug was discovered in early June using publicly available AI models, and that it took fewer than 20 prompts to uncover the vulnerabilities and create a working attack. Zoom issued a security advisory on Tuesday, including details about fixes the company has already begun rolling out to address the flaws, which affected devices running all operating systems that Zoom supports—Windows, macOS, Linux, iOS, and Android.
[…]
The vulnerabilities were specifically in the protocol used to facilitate real-time annotation during screen sharing.
I don’t understand how it could take over an iOS device when Zoom’s iOS screen sharing feature only allows observation, not control.
Dutch officials have warned that a high-severity macOS vulnerability that allows attackers to execute malicious code is under active exploitation.
“The NCSC has received a notification indicating that active abuse of this vulnerability has been observed on multiple systems on which port 5900 was accessible from the Internet,” the Netherlands National Cyber Security Centrum warned earlier this week. “In all these cases, root had been accessed on the affected system and a Monero crypto miner had been placed.”
Do you know if your screen sharing is on?
The vulnerability, tracked as CVE-2026-65400, received a patch from Apple last week for macOS Tahoe, Sequoia, and Sonoma. The vulnerability, with a severity rating of 7.1 out of 10, stems from a bug in the macOS screen sharing capability, which allows a remote party to view the screen and control the keyboard and mouse while a machine is turned on. A flaw in the “state management,” which keeps track of preceding events, user interactions, variables, and other system states, is the underlying cause.
In an update to the initial advisory, the Dutch agency said it received a report indicating that the vulnerability is being exploited in the wild in attacks where port 5900 is exposed to the internet.
According to the NCSC, the attacker obtained root access to the system and deployed a Monero cryptocurrency miner.
The vulnerability, identified as CVE-2026-65400, could allow an attacker on the network to authenticate to Screen Sharing without valid credentials. Reports now indicate that the vulnerability has been actively exploited on Macs where Screen Sharing was accessible from the Internet.
[…]
[We] strongly recommend that all Screens users install the latest macOS updates as soon as possible.
[…]
For users who want to further restrict access to Screen Sharing, Screens can connect to a Mac through an SSH tunnel instead of exposing the Screen Sharing service directly.
Apple has released macOS Tahoe 26.6.1, a rapid security update that addresses a serious vulnerability in the built-in Screen Sharing feature. The update, which arrived on Thursday without any new features, is strongly recommended for all Mac users running the latest version of the operating system.
Screen Sharing allows users to view and control another Mac remotely over a local network or the internet. It is widely used for remote support, file access, troubleshooting, and managing multiple Macs in homes, schools, or businesses. Once connected, a remote user can see the desktop, open apps, transfer files, and control the keyboard and mouse as if sitting at the machine.
The vulnerability could allow an attacker on the same network to authenticate to Screen Sharing without valid credentials. Apple fixed the issue through improved state management. The company has not indicated whether the flaw was being actively exploited in the wild.The same Screen Sharing bug affects earlier macOS versions, so Apple also issued companion security updates: macOS Sequoia 15.7.9 and macOS Sonoma 14.8.9.
Mac users can install the update by going to System Settings > General > Software Update. No corresponding updates for iOS, iPadOS, or watchOS were released alongside this Mac-only security patch.
MacDailyNews Take: Given the potential for unauthorized remote access, installing macOS Tahoe 26.6.1 (or the relevant update for older systems) promptly is advised.
Please help support MacDailyNews — and enjoy subscriber-only articles, comments, chat, and more — by subscribing to our Substack: macdailynews.substack.com. Thank you!
Apple has released updates to macOS 26.6.1, 15.7.9, and 14.8.9 to fix a Screen Sharing vulnerability that could let an attacker “on the network” connect without valid credentials. Update soon.
You manage all the devices that appear in Xcode as run destinations using Device Hub.
Run your app on simulated devices in Device Hub to quickly evaluate new features and fix bugs, and to see how your interface works on devices that you don’t have physical access to. Run your app on physical devices to test features or services that have hardware dependencies or investigating performance issues. For more information, see Running your app on simulated or physical devices.
Device Hub is undoubtedly a major surprise. It integrates simulators, physical device management, system state testing, and dynamic size adjustment into a new workflow. Its impact on day-to-day development experience may be more direct than that of many individual APIs. That said, iPhone apps now also support dynamic size adjustment, which will bring new challenges for developers, especially in terms of data and state organization. Adapting to different sizes is not something that can be solved merely by relying on dynamic layout containers. In many scenarios, large and small sizes correspond to very different navigation logic.
Xcode 27 introduced, among other new features, a new Device Hub app for developers that takes the place of the Simulator app. Where Simulator relied on separate windows for each device, Device Hub brings them all together into a single window where each simulated device is the detail view from a source list of devices on the left. It’s a more organized approach, made necessary by the wide variety of platforms Apple and Apple platform app developers have to build and test against.
[…]
In releases prior to Xcode 27, you could resolve this by importing the root public certificate into the simulated OS. On iOS, this could be done by dragging and dropping the .cer file onto the Simulator device window. Nothing would appear to happen, but you could then navigate to Settings, General, About, Certificate Trust Settings and mark the certificate as trusted.
[…]
In Xcode 27 with Device Hub, this process is much more uniform. […] While this new process does require you to wrap certificates in an Apple Configurator profile, this is much more consistent with how Apple’s device management system works, as it relies on signed profiles with policies, not loose .cer files. And now, just by adding the .mobileconfig to the Profiles section of the device inspector, the embedded certificate is automatically marked as trusted, greatly speeding up installation on new virtual devices.
Thanks to the remote control / screen sharing features of Device Hub, I can remotely navigate to Settings and start a software update on all my iOS27 devices without having to go collect them around the house 👌
For all of Apple’s nonsense about adding iPhone Mirroring to the EU, the new Device Hub (iOS Simulator) lets you remote-control your physical iOS devices just fine. I don’t think the DMA has an opt-out for developer tools 😛
It’s such a shame for now that Xcode 27’s Device Hub doesn’t support remote screen sharing with iOSes earlier than 27. I wish the screen sharing functionality was part of the developer disk image, and backported to iOS 26 and even iOS 18. Having a physical device plugged in somewhere is so much faster than booting a Simulator.
Xcode 27’s “Device Hub” is a broken shitshow, but most importantly, it lacks the Debug menu, where you could toggle slow animations and simulate memory warnings. Apple works tirelessly to destroy any good tool they used to have.
He has a thread of issues. Hopefully these will be addressed before it’s out of beta.
The Device Hub sometimes doesn’t kill CoreSimulator processes when you quit the app (not sure if this is a bug or intentional). Given that each device uses several hundred processes, the memory/processing impact is significant.
You’ll probably want to keep an eye on how many you have running: use right-click on the simulator in the list to “Shut Down” as necessary.
Apple’s built-in screen sharing support for Mac-to-Mac connections has always been a help for those of us with remote setups: headless Macs acting as servers, an office and home Mac, or the laziness of having Macs in different parts of your house you want to access without standing up.1
Under the hood, Apple relies on VNC (Virtual Network Computing), a fairly ancient standard at this point in time, and you probably get the sense of its creaking joints if you use the Screen Sharing app regularly.2 But it’s possible you didn’t know that, starting in Sonoma, Apple added a “super excellent” mode to Screen Sharing as an option when you connect two Macs with M-series chips. Called High Performance, it can deliver on its name.
Let’s shift into overdrive
When you initiate a connection, Screen Sharing asks you to pick between Standard and High Performance modes.
When you connect to another Mac using Screen Sharing, you’re given a choice of which mode to use. Let’s walk through the connection steps:
Either launch the Screen Sharing app and double-click the Mac’s name in a list, or, in the Finder, Control-click/right-click the Mac’s name and choose Screen Sharing. (There are still more ways to start, too.)
From the Select Screen Sharing Type options, you can select Standard, which is VNC-based, or High Performance, which adds Apple’s secret sauce on top.
Click Continue.
Enter your credentials.
The screen appears, and you may need to enter your macOS account password on the remote Mac to unlock it.
In that pathway, if you choose High Performance, you’re presented with different options. You can also click the info (i) button to the right of an existing connection in the Connections window in Screen Sharing, and choose High Performance from the Screen Sharing Type pop-up menu to save that option for the next connection.
A saved connection’s settings let you change the sharing type, display configuration, and port after the fact.
With a Standard connection, you get a pixel-for-pixel remote view of the other Mac’s display or displays. It’s just like you’re sitting in front of it. In fact, if you use the same account as the currently logged-in user, the remote Mac shows what you’re doing to anyone who looks at it. (You can log in as another user, and a session starts in the background that doesn’t appear on the remote display screen.)
High Performance takes a different approach. You can opt to create one or two virtual displays on the remote Mac, each with independent resolution, high-dynamic-range (HDR) support, and other features. It’s like being a remote user of the computer rather than sharing. (This mode doesn’t change the remote display resolution or other settings.)
With a High Performance connection between Apple silicon Macs, you gain these advantages:
You can choose one or two virtual displays, regardless of the number of displays connected to the shared computer.
The Dynamic Resolution option lets you resize a virtual display to the native resolution of your local screen, up to 4K (3840×2160 pixels) or, with HiDPI, up to 1920×1080. You can click the Dynamic button on the Screen Sharing toolbar or choose View: Dynamic Resolution during a live session.
Stereo audio passes over the connection, as does improved video. The connection supports HDR (for richer low-light and shadow tones), 4:4:4 chroma subsampling (uncompressed color data for improved fidelity), and high frame rates of 30 or 60 frames per second (for more stable video streaming, such as when watching a video or using video-editing software).
The downside of High Performance is that it imposes severe requirements for it to work well. You need 75 Mbps per 4K display and low network latency, which requires fast Wi-Fi with a gigabit-or-faster mesh or wired backbone if there are multiple network routers or base stations. However, that requirement also means that when you’re using High Performance, it feels very much like sitting in front of the other display rather than viewing it remotely.
The Screen Sharing toolbar with High Performance mode enabled offers controls unavailable in a Standard session; some options remain dimmed depending on the remote Mac’s capabilities.
If you want the depth of HDR Video, you have to enable it on the remote Mac via System Settings: Displays. The option for HDR Video appears in a Preset pop-up menu, but, of course, only if the display supports the right HDR signal. HDR can be enabled or disabled from the View menu and Screen Sharing toolbar, if it’s available.
Because the remote display is blacked out when using High Performance (even when connecting as the currently logged-in user), this can be seen as a privacy advantage if you have concerns about anyone else viewing the remote Mac’s screen. However, High Performance mode’s utility really lies in treating Screen Sharing like a high-speed display tunnel instead of a jerky remote view.
For further reading
If you’re looking for more detailed information about High Performance mode or any aspect of Mac-based file and screen sharing, you might consult my book, Take Control of Apple Screen and File Sharing.
[Got a question for the column? You can email glenn@sixcolors.com or use/glennin our subscriber-only Discord community.]
I don’t have a couch Mac and a kitchen Mac and a bedroom Mac and a… you get it. But I do have a downstairs office Mac and a laptop. ↩
Screen Sharing is found in /System/Applications/Utilities, just an oddity of how Apple locates certain apps on the immutable System volume. ↩
Login
