Cloud roundup: macOS Screen Sharing bug now under attack

Two security items today, both worth checking against your own fleet rather than waiting for the next patch cycle, plus an AWS monitoring feature that quietly kills a homegrown workaround a lot of us are running.

macOS Screen Sharing flaw is being exploited to plant Monero miners

CVE-2026-65400, a bug in macOS’s built-in Screen Sharing (VNC over TCP 5900) that let a network attacker connect without valid credentials, is now under active exploitation. The Netherlands’ NCSC says it’s seen abuse on multiple systems with port 5900 open to the internet — in every case the attacker landed root and dropped a Monero miner (BleepingComputer). Apple actually fixed this back on August 6 in macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9, but patch uptake on Macs sitting outside MDM is always spotty, and this is exactly the kind of service that gets enabled once for a support session and never turned off. If you manage any Macs — dev workstations, kiosk boxes, build machines — check whether Screen Sharing is on (System Settings → General → Sharing) and either disable it or confirm the update is installed. A crypto miner is the visible symptom; unauthenticated root access is the actual problem.

ShieldBreak: an unpatched Windows Defender bypass with a public PoC

Researcher Nightmare Eclipse published a technique called ShieldBreak that defeats a fix Microsoft shipped for an earlier Defender flaw (RoguePlanet), using a user-mode callback hook to tamper with file contents mid-scan via the Cloud Filter API (BleepingComputer). It affects Windows 10, Windows 11 25H2, and Windows Server, the PoC reportedly hits 100% on tested systems, and there’s no CVE or patch yet — Microsoft says it’s still investigating. It requires Defender to be enabled and running, so this isn’t remote-code-execution-from-nothing, but it is a working local privilege-escalation path with no fix on the horizon. Nothing to patch today, but worth flagging to whoever owns endpoint security on your Windows fleet so it’s on their radar before a patch lands, not after.

EC2 gets built-in application health checks

Amazon EC2 now has Application Status Checks — instance-level monitoring that periodically hits an HTTP/HTTPS port and path you define and confirms it returns the response code you expect, on a 60-second interval (AWS). It sits alongside the existing infrastructure status checks and plugs straight into Auto Scaling, which can replace an instance whose app-level check fails even if the instance itself looks perfectly healthy — a stopped web server, a crashed Docker daemon, a broken app dependency. If you’ve ever bolted a sidecar or a custom CloudWatch alarm onto an ASG just to catch “the instance is up but the app is dead,” this replaces that homegrown setup with a native, tag-or-instance-ID-scoped check. Available in every commercial region plus GovCloud, no extra infrastructure required.

Also worth a look

AWS Direct Connect has had degraded connectivity since 13:17 UTC yesterday for customers connected at the Equinix FR5 facility in Frankfurt — a co-location partner facility issue, not an AWS-side fault, with AWS recommending VPN failover in the interim. If you’ve got a DX connection through FR5 and no redundant path through another location, that’s worth checking on today.

Bottom line

Neither security item needs a fire drill, but both are worth five minutes: confirm Screen Sharing is off or patched on any internet-reachable Mac, and make sure Windows Defender’s ShieldBreak gap is on your endpoint team’s watchlist. The EC2 health check feature is the one to actually go try — it’s a straightforward win if you’re currently monitoring app health with anything homegrown.