How are people running their Macs exposed directly to the Internet?

In order to make this work, a user would have to:

1. Turn on screen sharing
2. Turn off the OS firewall block
3. Set up NAT routing on their router to forward port 5900 to their Mac

Seems to me that anyone who could do this would know it was a really bad idea?

Especially since you can already tunnel screen sharing via Apple ID or FaceTime to connect without leaving the port open.

The vulnerability, tracked as CVE-2026-65400, received a patch from Apple last week for macOS Tahoe, Sequoia, and Sonoma.

Apparently requires VNC to be open to the internet

It reads like: after someone deliberately configured their mac to expose a feature on the internet, someone “may” use it.

It’s probably one of those “security issue found by AI”.