Internet-exposed macOS Screen Sharing is yielding root accessWhite House creates a federally controlled private cyber operations…Lazarus campaign used a Windows zero-day to suppress endpoint visibilityAkira's Safe Mode tactic blinded controls before encryption failed

SECURITY.IO DAILY · THURSDAY 13 AUGUST 2026 · 06:00 AMERICA/ · Executive decision brief

Internet-exposed macOS Screen Sharing is yielding root access

NCSC-NL now reports active exploitation of CVE-2026-65400 against Macs exposing Screen Sharing to the internet, with attackers obtaining root access and installing cryptomining software.

Security.io Intelligence Desk · Thursday, 13 August 2026

Executive consequence

Treat CVE-2026-65400 as an exposure-led incident decision, not a fleet-wide patch statistic. Find Macs where Screen Sharing and internet reachability intersect, remove that path, install the fixed release and investigate previously exposed hosts for root-level persistence.

Decision today

Query fleet management for Screen Sharing state, fixed macOS release and internet reachability.

Read the full decision briefPrimary reporting: NCSC-NL · Apple · Security.NL

Executive priorities

What deserves attention before the rest of the news cycle.

Read First

Start with the macOS exposure check. Active exploitation is confirmed only where Screen Sharing is enabled and TCP port 5900 is internet-reachable, making inventory quality the immediate control.

Act Now

Require owners to return exposed-Mac results, targeted-Windows patch-and-hunt status, and ransomware data-theft closure evidence during the morning control call.

Emerging Risk

Attackers are using trusted operating states and legitimate infrastructure as concealment layers: Safe Mode, signed viewers, compromised webmail, exposed remote administration and authorised third-party capabilities.

Decision intelligence, not a headline feed.Every edition ranks what security leaders should read first, assign today and monitor next.

Six-minute executive briefing

Security.io Daily Headlines

Five equally weighted stories: what happened and the leadership decision each creates.

Read today’s headlines

Today’s decision ledger

What changed · Why it matters · What to do

Regulatory

White House creates a federally controlled private cyber operations programme

Why it matters

The United States has created a framework for government-directed private cyber operations against designated foreign criminal organisations.

Do today

Brief the general counsel and board risk sponsor on the memorandum's controlled participation model.

Read the briefing →

Threat Intelligence

Lazarus campaign used a Windows zero-day to suppress endpoint visibility

Why it matters

Prioritise CVE-2026-68820 where targeted personnel or suspicious PDF delivery create a plausible foothold. The August Windows update closes the privilege-escalation route, but evidence-based closure requires hunts for the delivery chain, EDR impairment and abused web infrastructure.

Do today

Deploy the August Windows updates to endpoints supporting defence, aerospace and aviation personnel.

Read the briefing →

Ransomware

Akira's Safe Mode tactic blinded controls before encryption failed

Why it matters

Add Safe Mode transitions to ransomware detections and treat failed encryption as an incomplete attack, not a contained one. The observed Akira attempt disabled controls successfully even though memory constraints prevented encryption after credentials and files had already been stolen.

Do today

Alert on Safe Mode boot events and boot-configuration changes on managed Windows systems.

Read the briefing →

Vulnerability Management

NIST asks how the NVD should operate in the age of AI

Why it matters

Use NIST's consultation as a trigger to map every enterprise dependency on NVD data and formalise controls for AI-assisted vulnerability decisions. The notice is not a new standard or immediate schema change, but it signals the direction of a foundational security-data service.

Do today

Map scanners, dashboards, compliance controls and ticketing workflows that consume NVD data.

Read the briefing →

Signal desk

Evidence that changes prioritisation

LEAD DECISION PROFILE

CVE-2026-65400 executive priority score

Security.io scores each dimension from 0–100. Exposure weighs reachable attack surface, Urgency weighs exploitation and remediation time, and Business Consequence weighs privilege and operational impact. Source: Security.io editorial scoring informed by NCSC-NL and Apple evidence; values are not external telemetry..

Back page

Daily comic · Circuit Chuckles

A brief pause after the intelligence

Evidence of Security

Rusty mistakes complete compliance paperwork for proof that the underlying security controls work.

Thursday, 13 August 2026Open comic page →

In a four-panel black-and-white newspaper comic in a records room, Rusty celebrates shelves full of compliance binders while Glitch holds up a lock and points out that the binder only says the control exists.