Apple Patches CVE-2026-43760 Screen Sharing Flaw Granting Root Access on macOS
A vulnerability in the Screen Sharing feature of macOS allows remote attackers to execute commands with root privileges on affected systems. The flaw, tracked as CVE-2026-43760, resides in the screensharingd service and impacts configurations where Screen Sharing or Remote Management is enabled together with the legacy option permitting VNC viewers to connect using a password.
Exploitation requires the attacker to know the configured VNC password. Because connections authenticated via the VNC mechanism are not bound to a specific macOS user account, file-transfer components continue to run with root privileges. Researchers demonstrated that an attacker could request protected system files such as /etc/sudoers or create new files inside normally restricted directories.
The ability to write files significantly increased the impact. An attacker could insert a policy file into /private/etc/sudoers.d and grant a non-administrative account the right to execute commands via sudo without providing a password.
The Apple security bulletin describes the impact as possible access to sensitive user data. The company released fixes for CVE-2026-43760 in macOS Tahoe 26.6 and macOS Sonoma 14.8.8 on July 27, 2026.
Related articles
The Tale of Active Directory Domain Sabotage: Architect Plants DNS-Killing Task on Departing Branch Controllers
A detailed case study from a former Windows Server 2003 Active Directory environment describes how an architect embedded a monitoring script on branch domain controllers to detect prolonged loss of VPN connectivity to headquarters. The script incremented a hidden registry counter each time the head office IP failed to respond and triggered a net stop dns command once the threshold was exceeded, effectively collapsing the AD domain for the departing branches. The architect later cleaned up traces by reassigning tasks and ownership to the SYSTEM account. A network engineer eventually noticed the repeated DNS service stops, restarted the service multiple times, and eventually contacted the architect. The story illustrates both the critical dependency of Active Directory on DNS and the inherent risk posed by highly privileged administrators who can weaponize that dependency. Two main conclusions are drawn: DNS failure immediately renders an AD domain unusable, and every domain administrator represents the primary threat to domain integrity.
CISA Adds Ray AI Framework Flaw CVE-2025-62593 to KEV Catalog After Confirmed Exploitation
US authorities have issued a warning that a critical vulnerability in the Ray framework for scaling AI and Python applications is being actively exploited in real-world attacks. The flaw, tracked as CVE-2025-62593, allows remote code execution through browsers such as Firefox and Safari, potentially enabling attackers to run malicious code simply by displaying an ad on a compromised page. CISA added the issue to its Known Exploited Vulnerabilities catalog on August 17, 2026, and directed federal agencies to apply mitigations by August 20. Originally disclosed in November 2025 and fixed in Ray version 2.52.0, the vulnerability carries a CVSS v4.0 base score of 9.4 and is rated Critical. Developers using Ray in environments that also run Firefox or Safari face additional risk from DNS rebinding attacks that can lead to code injection. Organizations relying on Ray are urged to verify patch status and monitor for signs of compromise.
GitLab Issues Critical Security Updates Fixing Unauthenticated Project Modification Flaws
GitLab has released security updates for its Community Edition and Enterprise Edition platforms to address two vulnerabilities, including one rated critical. The flaws were reported through the company's bug bounty program and affect multiple supported versions. CVE-2026-19478 is a code injection issue that allows remote attackers to tamper with or delete public projects and user data via GraphQL directives without authentication under certain conditions. CVE-2026-19650 is a CSRF vulnerability stemming from insufficient validation in GraphQL multiplexed query handling, enabling mutation execution through GET requests. Both CVEs received high CVSS scores, prompting GitLab to urge immediate upgrades to versions 19.2.4, 19.1.6, 19.0.8, and 18.11.11.
VoLTE Video Call Vulnerability Grants Kernel Access on Unisoc Android Chips
Researchers from SSD Secure Disclosure have disclosed a two-stage attack chain that achieves remote kernel access on Android devices powered by Unisoc chipsets. The exploit begins with a remote code execution flaw in the modem firmware that is triggered by a specially crafted VoLTE video call. Once code executes on the modem, a second privilege-escalation issue abuses shared physical memory between the modem and application processor to reach Android kernel memory. The attack requires an attacker-controlled 4G network and VoLTE infrastructure, and the victim must answer the incoming video call. Vulnerable chip families include T606, T612 and T7250, found in devices such as the Motorola E13, Realme C33 and Xiaomi Redmi A5. No patch or CVE identifier has been issued by Unisoc, and the August Android security bulletin does not address the issue.