Hackers are exploiting a macOS Screen Sharing flaw to gain root access and install Monero miners on Macs with port 5900 exposed online. The Dutch National Cyber Security Centre confirmed active exploitation of a critical macOS authentication flaw, tracked as CVE-2026-65400 (CVSS score of 9.8), less than two weeks after Apple shipped the fix. The bug sits in macOS’s built-in Screen Sharing feature, the remote desktop tool baked into every Mac. Apple’s fix improved how the system manages authentication state, closing a gap that let attackers on the network authenticate to Screen Sharing without valid credentials at all. Apple patched this issue with the release of macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, and macOS Sonoma 14.8.9, crediting researcher Alfredo Pesoli (@__rev) at Bynario Atlas (bynar.io) for the discovery. “An attacker on the network may be able to authenticate to Screen Sharing without valid credentials” reads the advisory. That’s a fast, coordinated fix by industry standards. It just wasn’t fast enough to beat whoever started scanning for exposed systems. NCSC-NL says it received reports of active abuse hitting multiple systems where port 5900, the port Screen Sharing runs on, was reachable directly from the internet. “The vulnerability concerns an authentication issue in the Screen Sharing functionality where network attackers can gain access without valid credentials. This is made possible by insufficient state management during the authentication process. As a result, unauthorized individuals can perform authentication attempts that would normally not be accepted.” reads the advisory. “The NCSC has received a security advisory indicating that active exploitation of this vulnerability has been observed on multiple systems where port 5900 was accessible from the internet. In all these cases, root access was obtained on the affected system and a Monero crypto miner was placed.” In every case documented so far, attackers gained root access and dropped a Monero cryptocurrency miner on the compromised machine. Cryptomining is a relatively boring payload compared to what root access on a Mac could actually enable, which makes this look more like opportunistic scanning than a targeted campaign, for now. This flaw sits in the same source code file as two other Screen Sharing bugs Apple patched a month earlier in macOS 26.6, one of them a genuinely pre-authentication flaw that a researcher going by @osxreverser described needing nothing but a target’s IP address to exploit, no password, no username, nothing. That researcher claimed to have found around 40,000 exposed Screen Sharing hosts on the internet during a scan, nearly half of them in the US, spanning residential connections, university networks, and at least a few corporate servers. What ties both bugs together is how mechanically simple they are to trigger. Security firm Calif, which analyzed the flaws, found no memory corruption, no exploitation trickery, no race condition to win, just logic errors that let a couple of correctly ordered packets walk straight past authentication. Calif also said it built a working exploit for both vulnerabilities in about four hours using an AI coding agent, which is the detail that should worry defenders more than the Monero miner itself: the gap between a patch note and a working exploit keeps shrinking, and it’s shrinking because building the exploit barely takes effort anymore. If you’re running a Mac with Screen Sharing enabled and haven’t updated yet, do it now rather than after finishing this article. And if updating isn’t possible immediately, turn Screen Sharing off entirely under General, Sharing, until you can; leaving port 5900 open to the internet at this point is less a risk than an open invitation. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Monero)
GeoServer faces an unpatched zero-day enabling SQL injection and potentially RCE, with attackers already probing exposed systems. A newly disclosed GeoServer zero-day is already attracting active exploitation attempts, and there is no patch available yet. Organisations running the open-source geospatial platform should check their exposure. A security researcher with the handler q1uf3ng discloded the vulnerability that has yet to be assigned a CVE identifier. 实话说今天是非常不开心的一天 实际上最近一段时间我都非常沮丧 各种事情 所以我公布一个0day 希望让你们心情变的开心 GeoServer jsonArrayContains 未授权 SQL 注入 数据库sa的情况下理所当然的可以rce pic.twitter.com/0uTUyMNYU4 — 秋风 (@q1uf3ng) August 12, 2026 The flaw lies in the jsonArrayContains functionality and allows unauthorised SQL injection. Under some configurations, especially where the service can reach a privileged database account, that path may lead to remote code execution The vulnerability has yet to be assigned a CVE identifier. The issue was publicly disclosed on 12 August 2026. Within hours, watchTowr said it had begun seeing exploitation attempts, with hundreds of probes coming from a small number of IP addresses. “Within hours of public disclosure, we began observing exploitation attempts and have since recorded hundreds of attempts originating from a small number of source IP addresses. Yet another example of how quickly attackers move once a vulnerability enters the public domain,” said WatchTowr’s Jake Knott. That timing matters. Once a proof of concept or enough technical detail is public, attackers don’t need to wait for a polished exploit. They can scan broadly, trigger errors, compare responses, and build a list of systems worth revisiting later. It’s reconnaissance with an error message as a compass. Threat actors are probing vulnerable GeoServer systems, but no follow-up activity has been observed yet. However, researchers warn exploitation could soon escalate. “However, this is unlikely to remain the case for long: GeoServer has a track record of being targeted and exploited at scale, with multiple vulnerabilities listed in CISA’s Known Exploited Vulnerabilities catalog,” Knott added. “With no patch currently available and exploitation already underway, organizations running GeoServer should take this vulnerability seriously and, where possible, identify exposed instances, restrict public access, and monitor for a vendor fix,” Attackers are probing GeoServer systems for the unpatched zero-day, triggering errors to identify vulnerable targets before likely exploitation. GeoServer is a popular platform for publishing and sharing geographic data through web services. It appears in public-sector portals, environmental platforms, mapping projects, utilities, transport systems, research institutions, and internal business applications. That makes a remotely reachable instance more than a technical footnote; it may expose geospatial information, backend services, credentials, or a route into a wider network. The absence of a patch changes the usual response. Teams cannot simply schedule an update and move on. They need to identify every GeoServer instance, determine whether it is internet-facing, restrict access wherever possible, inspect logs for unusual requests and database errors, and limit the permissions available to the application’s database account. This is also not GeoServer’s first encounter with active exploitation. In 2024, attackers used the critical GeoServer GeoTools vulnerability CVE-2024-36401 (CVSS score of 9.8), to pull compromised systems into DDoS and cryptocurrency-mining botnets and residential proxy networks. That history does not prove that every exposed instance will be compromised this time, but it does make complacency hard to defend. The practical priority is exposure reduction. Put GeoServer behind a VPN, a reverse proxy, IP allow-listing, or another access-control layer if the service does not need to be public. If public access is unavoidable, treat it as a temporary high-risk exception, watch it closely, and prepare to apply the vendor fix as soon as it arrives. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, zero-day)
The Netherlands’ National Cyber Security Centre (NCSC) is warning that hackers are actively exploiting a macOS authentication bypass vulnerability after public exploit code emerged. The security issue lies in macOS Screen Sharing, a built-in remote desktop feature that allows remote desktop control over a network, using the VNC protocol over TCP port 5900. Apple fixed CVE-2026-65400 on August 6 in macOS Tahoe 26.6.1 and earlier releases. The flaw allows network-based attackers to gain access without valid credentials. An attacker could use this access to open applications remotely, access files, change security settings, and perform various other actions. In an update to the initial advisory, the Dutch agency said it received a report indicating that the vulnerability is being exploited in the wild in attacks where port 5900 is exposed to the internet.
Oil giant Shell has confirmed it is investigating a potential security incident after the Clop ransomware gang claimed it stole 89GB of data. Shell is a British multinational energy conglomerate and one of the world's top three oil and gas companies, after Chevron and ExxonMobil. It has 85,000 employees in more than 70 countries and operates a massive network of tens of thousands of service and recharge stations that serve over 20 million customers daily. According to a recent post on Clop's dark web data leak site, the allegedly stolen files include engineering drawings, scans of facility testing reports, photos of the facilities, and project plans. "We are aware of a potential incident. We are working with our security teams and relevant experts to investigate," a Shell spokesperson told BleepingComputer when asked to confirm Clop's data theft claims.
The ShinyHunters extortion group stole personal information from 1.6 million RingCentral accounts after hacking the company in July, according to the data breach notification service Have I Been Pwned. RingCentral is a cloud-based collaboration and communication platform used by over 600,000 businesses for services such as calling, messaging, and voicemail. The company disclosed the incident on July 28, revealing that its systems were compromised following what it described as a "sophisticated social engineering campaign." "We have not seen any new unauthorized activity since taking these remediation efforts. To date, this incident has affected data for a limited portion of RingCentral customers, and we are communicating with affected customers directly," it noted. "If you are not contacted by RingCentral, you are not affected. This incident did not impact the core RingCentral platform, and our services continue to operate without disruption."
7.3 million Chess.com profiles leaked online: the data is genuine, but evidence points to large-scale scraping, not a server breach. Free is a strange price for stolen data, and that’s exactly what makes this listing worth a second look. A 15.5 GB file containing over 7.3 million chess.com user records showed up on two data-leak forums this week, no cost, no ransom demand, just handed out. Ransomnews’s technical analysis confirms the data is real and recent. What it isn’t, on the evidence, is a hack. “The archive is a single 744 MB 7-Zip file that expands to a 15.5 GB tab-separated table: one header row and 7,337,395 records, each with 38 fields. The schema is chess.com-specific throughout. Alongside the obvious identifiers, email, partial email, username, user ID, UUID, first and last name, country, location and locale, it carries platform state: chess title, points, skill level, premium status and label, verification and activation flags, best rating and rating type, official rating, member-since and last-login timestamps.” reads the report published by Ransomnew. “Two fields at the end are the interesting ones. Every record has gam_audiences and audiences_member_of populated, Google Ad Manager audience segments, with values like coach-nudge experiment groups, trial eligibility, lapsed-user cohorts and rating-band targeting. Those are marketing-stack fields, not profile data. They do not appear in chess.com’s public API.” The file carries email addresses, usernames, real names, countries, chess ratings, subscription tiers, and something odder: internal Google Ad Manager audience tags, the kind of marketing segmentation data that never shows up in chess.com’s public API. Roughly three-quarters of records include an email address. There are no passwords, no password hashes, and no payment data anywhere in the file, which matters a lot for how seriously affected users need to react. Proving this data is genuine didn’t require touching chess.com’s servers at all. Every account UUID in the file is a version-1 identifier, the kind that embeds the exact timestamp it was generated, and researchers decoded that hidden timestamp across 200,000 sample records to compare it against each account’s registration date. The match rate came back at 100%, which isn’t something anyone could fake without possessing actual chess.com-issued identifiers down to the millisecond. Three separate details point toward scraping rather than an actual system breach. The data wasn’t captured in one moment, it was stamped across nine consecutive days in daily batches, the pattern of a scheduled collection job rather than a single database dump. About 7.4% of user records appear twice, the same accounts revisited on different days, something that simply doesn’t happen inside a genuine database export. This has happened to chess.com before, and the company was blunt about it at the time. Back in 2023, a similar leak of 828,000 records surfaced with a nearly identical field structure, and chess.com stated plainly, “In November 2023 a threat actor published 828,000 chess.com records with a near-identical field set. Chess.com’s response then was unambiguous: as it told Hackread, “This was NOT a data breach.” continues the report. “Our infrastructure, member accounts, and data such as passwords are secure.” The data had been pulled by abusing the platform’s find-friends feature, feeding in externally sourced email addresses to resolve them against accounts. A second scrape affecting roughly 476,000 users followed. This 2026 file is the same technique at roughly nine times the scale.” That earlier incident came from abusing the platform’s find-friends feature to resolve external email lists against real accounts; this new file looks like the same technique running at roughly nine times the scale. One detail doesn’t fit a purely public-facing scrape, though. Advertising-audience segment data isn’t something chess.com’s open API exposes, and it appears on every single row in this file, which suggests whoever built this had access to an authenticated or internal-facing endpoint rather than just the public developer tools. That’s the specific question chess.com is best positioned to answer, and it’s the one that actually matters for understanding how this happened. The account distributing the file, going by V0idix, isn’t monetizing anything here. The same handle has posted dozens of free database dumps across other unrelated companies, building reputation through volume rather than through sales, which fits a collector who harvests and republishes data rather than someone selling access to a fresh intrusion. None of this means chess.com users should shrug it off just because passwords weren’t exposed. A verified email sitting next to a real name, country, skill rating, and subscription tier is more than enough raw material for a convincing phishing message about a membership renewal or a fair-play dispute. The right response isn’t panicking about a hacked account, it’s treating unexpected chess.com emails with more suspicion than usual and checking whether that same email address has turned up anywhere else, since reused credentials remain the far more dangerous exposure than anything sitting in this particular file. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Chess.com)
Trump authorizes vetted US cybersecurity firms to conduct government-approved cyber operations against transnational criminal networks. President Trump signed a national security memorandum on August 13 establishing a formal program that allows vetted private US cybersecurity companies to conduct offensive cyber operations against transnational criminal organizations under government direction and oversight. The program, managed by the National Coordination Center, covers both intelligence collection, described as Cyber Surveillance Operations, and active disruption of criminal infrastructure, described as Cyber Effects Operations. It’s the formal implementation of what the White House’s Cyber Strategy for America promised in March: unleashing the private sector as an offensive cyber instrument. “The American private sector is the most innovative and technologically advanced in the world, and its scale, speed, and capacity secure a critical offensive cyber advantage for the United States. Yet, American businesses’ innovative capabilities have historically been underutilized in efforts to identify and disrupt criminal networks operating in cyberspace. Thus, it is the policy of the United States to use all instruments of national power, including the innovative capabilities of the private sector, to combat cybercrime.” states the memorandum. “By partnering with vetted United States companies subject to the direction and oversight of the Federal Government, we will enhance our ability to counter TCO threats and combat transnational cybercrime, fraud, and other predatory schemes against American citizens.” The program targets what the memo defines as Cyber-Enabled Transnational Criminal Organizations, any foreign group conducting cyber-enabled crime against US interests, explicitly excluding entities that are institutional parts of foreign governments or wholly operated under foreign government direction. That carve-out matters: this program is aimed at criminal networks, not nation-state adversaries. The line between the two is often blurry in practice, but the memo establishes the presumption that a group is not government-directed unless clear intelligence says otherwise. ““Cyber Effects Operation” means activity conducted in or through the interdependent network of information technology infrastructure that includes the Internet, telecommunications networks, computers, information systems, industrial control systems, networks, and embedded processors and controllers that results in the manipulation, disruption, denial, degradation, or destruction of information systems, networks, physical or virtual infrastructure controlled by information systems, or information resident thereon.” continues the memorandum. Program executive directors from the Department of Justice and the Department of Homeland Security must co-approve every operation in writing before any action is taken. Operations that could produce those Critical Outcomes require additional authorization beyond the program executive directors, an explicit acknowledgment that some cyber actions cross into territory governed by the laws of armed conflict. Companies wanting to participate must clear rigorous vetting, demonstrate technical capability, submit to annual evaluations, and maintain a bond or escrow of at least $1 million that is forfeited if they violate their contract terms. The operational procedures are to be finalized within 60 days, and the Justice Department will review any operation that touches a US person or raises domestic constitutional questions. The legal question hovering over the whole program is whether the CFAA exemption for lawfully authorized government investigative activities extends to private companies acting under government contracts, a question no US court has yet answered. Jenner & Block lawyers noted the exemption likely applies when companies operate under direct government direction, but wouldn’t cover independent offensive operations without that oversight. That’s precisely why the memo makes government control explicit at every step: every operation needs written approval before action, every unintended contact with a US person or system must trigger an immediate stop and notification, and the Justice Department stays in the loop throughout. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Transnational Criminal Networks)
An Akira ransomware affiliate disabled the endpoint detection and response (EDR) solution on a compromised system by restarting the machine into Safe Mode with Networking. The attack occurred on August 4 after the hacker obtained initial access through an exposed SonicWall VPN device without multi-factor authentication (MFA). Managed detection and response (MDR) services company Huntress says that roughly two hours after a successful VPN login, the attacker connected to the domain controller via RDP, enumerated Active Directory users and computers, and then moved to an application server. They used WinRAR to archive mapped file shares and the s5cmd command-line tool to upload the stolen data to an attacker-controlled S3 bucket, before installing AnyDesk for remote access. At that stage, the attacker used AnyDesk to force the compromised host to boot into Safe Mode with Networking and disable both the Huntress agent and Microsoft Defender’s real-time protection.
Hardware wallet manufacturer Trezor disclosed a data breach affecting nearly 14,000 of its customers after ShipMonk, its shipping and logistics provider, was hacked. During the incident, the attackers gained access to customers' order data, including their full names, shipping addresses, email addresses, and phone numbers. As the company explained in a Thursday blog post, the resulting data breach affects customers from the United States, the United Kingdom, Sweden, Colombia, Brazil, Italy, and Portugal who received orders between May 10th and August 8th, 2026. "On Monday, August 10, 2026, one of our shipping providers, ShipMonk, informed us of unauthorized access to their systems containing customer data," Trezor said. "The incident affects 11,742 customers with full exposure (name, email, phone number, shipping address) and 1,947 customers with partial exposure (name, city, email)."
CEVA Logistics suffered a cyberattack disrupting European operations, with eight warehouses affected and shipments halted at impacted sites. CEVA Logistics suffered a cyberattack on July 29 that disrupted parts of its European operations. The incident impacted impacted eight warehouses, and the company is still working to restore impacted services. CEVA Logistics operates in more than 170 countries and is part of the CMA CGM Group, one of the world’s largest shipping and logistics companies. On August 1, CEVA notified affected customers that goods stored at the disrupted facilities could not be shipped, highlighting the attack’s direct impact on logistics and supply chain operations. The company did not disclose technical details about the attack or the threat actor behind the incident. At this time, no ransomware group claimed the responsibility. The Register reported that the attack exposed customer data linked to major clients, including Valve and Ajax. Valve said payment details, passwords and Steam Guard codes were not exposed because CEVA does not have access to them. However, the stolen customer data could still be used by cybercriminals to craft convincing phishing campaigns. Valve warned users to be cautious of suspicious emails or messages that may exploit information obtained in the breach to impersonate trusted services and trick victims into revealing sensitive information. Some affected organizations warned that personal information may have been exposed, in addition to the delays affecting order shipments. Dutch premium department store chain De Bijenkorf , which was also impacted, reported that the securoty breach may have exposed names, addresses, email addresses, phone numbers, and online order details. No financial data was impacted. “Based on the current information, the following data may be involved: -Name and contact details, such as email address, address, and telephone number. -Data regarding online orders, such as products, prices, discounts, delivery information, and a description of the payment method used.” reported the company. “For business customers, the company name and VAT number may also be involved if these have been entered in My Account. In the case of severely outdated VAT numbers for freelancers and sole proprietorships, a VAT number may be composed of a citizen service number.” In November, a hacker reportedly offered the company’s database for sale on a dark web marketplace, claiming it contains customer lists, shipping records, contracts, pricing information and banking details. Such data could enable fraud, impersonation and attacks against global supply chain operations. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, logistics)
Confirm this action.
Leaving now will discard your changes.