--- schema: 1 kind: vulnerability title: > CVE-2026-65400 — macOS Screen Sharing lets a network attacker authenticate without valid credentials, the second severe defect in the same daemon in two releases headline: > Attackers exploit a macOS Screen Sharing flaw that lets a network attacker in as root without valid credentials, fixed in 26.6.1 summary: > Apple's macOS 26.6.1, Sequoia 15.7.9 and Sonoma 14.8.9 updates of 2026-08-06 fix CVE-2026-65400 in Screen Sharing, where "an attacker on the network may be able to authenticate to Screen Sharing without valid credentials", addressed through improved state management. The flaw is exploited in the wild: NCSC-NL reported active abuse on 2026-08-12 and CISA added it to its Known Exploited Vulnerabilities catalog on 2026-08-18. It lands one week after macOS reverse-engineer fG! described a pre-authentication file-download bug in the same screensharingd daemon, which Calif counts as a separate flaw fixed in the preceding release and Huntress ties to CVE-2026-65400. Patching and disabling Screen Sharing where it is not needed do not depend on settling that. discovered_at: "2026-08-08T05:06:00Z" updated_at: "2026-08-16T04:50:00Z" event_date: 2026-08-06 run_id: 2026-08-08T0409Z-intel priority: high immediate_action: null tags: - vulnerabilities - auth-bypass - patch-available - pre-auth - rce - poc-public - actively-exploited - cryptocrime regions: - global - europe sectors: - public-sector - technology - healthcare - finance - education entities: [] techniques: - T1021.005 - T1190 - T1543.004 - T1546.004 - T1496 affected_products: - Apple macOS Tahoe - Apple macOS Sequoia - Apple macOS Sonoma cves: - id: CVE-2026-65400 cvss: "7.1" epss: null type: auth-bypass vector: zero-click auth: pre-auth status: - exploited - poc-public - patch-available affected: "macOS Tahoe below 26.6.1, Sequoia below 15.7.9, Sonoma below 14.8.9" fixed: "macOS Tahoe 26.6.1, Sequoia 15.7.9, Sonoma 14.8.9" sources: - url: "https://support.apple.com/en-us/148170" publisher: Apple date: 2026-08-06 role: primary - url: "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0280" publisher: NCSC-NL date: 2026-08-07 role: corroborating - url: "https://reverse.put.as/2026/07/29/its-a-pre-auth-stupid/" publisher: "fG! (reverse.put.as)" date: 2026-07-29 role: corroborating - url: "https://blog.calif.io/p/no-country-for-old-passwords" publisher: Calif date: 2026-08-10 role: primary - url: "https://www.huntress.com/blog/macos-screen-sharing-rce-patched" publisher: Huntress date: 2026-08-07 role: corroborating - url: "https://advisories.ncsc.nl/2026/ncsc-2026-0280.html" publisher: NCSC-NL (Nationaal Cyber Security Centrum) date: 2026-08-12 role: primary - url: "https://www.bleepingcomputer.com/news/security/hackers-exploit-macos-screen-sharing-flaw-to-deploy-monero-miner/" publisher: BleepingComputer date: 2026-08-14 role: corroborating - url: "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json" publisher: "CISA KEV catalog" date: "2026-08-18" role: corroborating - url: "https://support.apple.com/en-us/148171" publisher: "Apple" date: "2026-08-06" role: primary - url: "https://support.apple.com/en-us/148172" publisher: "Apple" date: "2026-08-06" role: primary closed_sources: [] evidence: - quote: An attacker on the network may be able to authenticate to Screen Sharing without valid credentials publisher: Apple - quote: An authentication issue was addressed with improved state management. publisher: Apple - quote: "screensharingd, the program answering those connections, runs as root, the account that can do anything, so an attacker did not stop at your account. They could breach every other account on the machine and install whatever they wanted." publisher: Calif - quote: "Where the first bug is a stale return value, the second is a state machine desync. Anybody could probably reproduce it from the patch now, but we are withholding the details until more people have upgraded." publisher: Calif - quote: "The daemon's frame-length validator erroneously returns a stale success status, so the connection is treated as authenticated." publisher: Huntress - quote: "As this is a pre-auth bug, the usual hardening does not help: removing allowed user accounts, disabling legacy VNC password authentication, or rotating the VNC password have no effect." publisher: Huntress - quote: "The NCSC has received a report showing that active abuse of this vulnerability was observed on multiple systems on which port 5900 was reachable from the internet. (translated from Dutch)" original: "Het NCSC heeft een melding ontvangen waaruit blijkt dat er actief misbruik van deze kwetbaarheid is waargenomen op meerdere systemen waarop poort 5900 vanaf het internet bereikbaar was." publisher: NCSC-NL - quote: "In all of these cases root access was obtained on the affected system and a Monero crypto miner was planted. (translated from Dutch)" original: "In al deze gevallen was root toegang verkregen op het getroffen systeem en een Monero crypto miner geplaatst." publisher: NCSC-NL - quote: "Public PoC code available and active abuse known (translated from Dutch)" original: "Publieke PoC code beschikbaar en actief misbruik bekend" publisher: NCSC-NL verification: multi-source sourcing_note: > Apple publishes no severity score of its own; the CVSS 7.1 recorded here is NCSC-NL's. fG!'s screensharingd defect and his claim that Apple listed its fix as a denial-of-service issue are his own assertions, which Apple has not endorsed, and Huntress and Calif disagree on whether that defect is CVE-2026-65400. confidence: medium references: [] deep_dive: false deep_dive_category: null org_triage: null classification: reliability: A credibility: 2 watchlist_hit: false actions: - "Patch every Mac to macOS 26.6.1 / 15.7.9 / 14.8.9 and turn Screen Sharing off wherever it is not actively needed; close port 5900 at the network edge and confirm no host still answers Screen Sharing from the internet. Re-check hosted or leased bare-metal Macs after provisioning, which Huntress reports being built from vulnerable images." - "Run a compromise assessment on every Mac that answered Screen Sharing from the internet before it was patched: look for an unexpected long-running high-CPU process, because the confirmed outcome on exploited hosts was root plus a planted cryptocurrency miner." updates: - at: "2026-08-11T04:45:00Z" run_id: 2026-08-11T0411Z-intel type: update summary: > Update to this pipeline's 2026-08-08 entry, which carried only Apple's advisory line that an attacker on the network might authenticate to Screen Sharing without valid credentials. Three deltas change the urgency. The daemon that answers those connections runs as root, so this is a pre-authentication remote root primitive rather than a login as one user; researchers rebuilt working exploits from the 26.6.1 binary diff in about four hours, and did the same for a second, independent pre-auth bug in the same source file that Apple closed silently on 2026-07-27 with no CVE; and a researcher scan cited by Calif found roughly 40,000 Macs with Screen Sharing reachable from the internet, and Huntress separately counts tens of thousands of potentially vulnerable hosted bare-metal Macs, noting that some of those providers had not yet folded the fix into their base provisioning images. Calif and Huntress give incompatible root causes for CVE-2026-65400 itself and this entry reports both. Patch to macOS 26.6.1, 15.7.9 or 14.8.9; removing allowed accounts or the VNC password does not help. fields: - actions - cves - evidence - priority - sectors - sources - tags - techniques - body merged_from: 2026-08-11/cve-2026-65400-screensharingd-remote-root-two-preauth-bugs - at: "2026-08-16T04:50:00Z" run_id: 2026-08-16T0411Z-intel type: update summary: > CVE-2026-65400, the pre-authentication flaw in the macOS Screen Sharing daemon this pipeline covered on 2026-08-08 and again on 2026-08-11 as having no confirmed in-the-wild exploitation, is now confirmed exploited. NCSC-NL revised advisory NCSC-2026-0280 on 2026-08-12 to record that it had been notified of active abuse observed on multiple systems with port 5900 reachable from the internet, and that in all of those cases root access was obtained and a Monero cryptocurrency miner was planted. Nothing about the remediation changes — macOS 26.6.1, Sequoia 15.7.9 and Sonoma 14.8.9 — but the exposed population the prior entry counted at roughly 40,000 hosts now has a confirmed outcome attached to it. fields: - actions - cves - evidence - regions - sources - tags - techniques - body merged_from: 2026-08-16/cve-2026-65400-screen-sharing-confirmed-exploited-monero - at: "2026-09-30T06:44:45Z" run_id: 2026-09-30T0639Z-audit type: correction summary: > The summary still said no exploitation was reported, and the main text that Apple reported none, after NCSC-NL confirmed active abuse on 2026-08-12 and CISA listed the flaw on 2026-08-18. The main analysis also called it a straightforward patch item with no artifact to look for. It now gives the daemon's root context, the disagreement between Huntress and Calif over which flaw fG!'s proof-of-concept exploited, and Huntress's authentication-type and session-user discriminator, and it drops an unsourced mDNS claim and an unsourced link between the confirmed cases and that discriminator. The 2026-08-11 claim that such a session has no benign explanation is narrowed to Huntress's wording. NCSC-NL reports a planted miner and has not said whether the attacks went further, so the 2026-08-16 text no longer rules out data theft or ransomware. fields: [summary, actions, sources, body, sourcing_note, headline, evidence] migrated_from: null --- Apple's 2026-08-06 updates for macOS Tahoe 26.6.1 ([Apple, 2026-08-06](https://support.apple.com/en-us/148170)), Sequoia 15.7.9 ([Apple, 2026-08-06](https://support.apple.com/en-us/148171)) and Sonoma 14.8.9 ([Apple, 2026-08-06](https://support.apple.com/en-us/148172)) fix CVE-2026-65400 in Screen Sharing, the VNC-based remote-desktop service built into macOS. Apple's description of the impact is unusually direct for a first-party bulletin: "An attacker on the network may be able to authenticate to Screen Sharing without valid credentials", with the cause given as "An authentication issue was addressed with improved state management" ([Apple, 2026-08-06](https://support.apple.com/en-us/148170)). NCSC-NL carried it to European constituents the following day, classing it CWE-287 ([NCSC-NL, 2026-08-07](https://advisories.ncsc.nl/advisory?id=NCSC-2026-0280)). Apple published no severity score. NCSC-NL reported on 2026-08-12 that active abuse had been observed on multiple systems whose port 5900 was reachable from the internet, with root access obtained and a Monero miner planted in every case ([NCSC-NL, 2026-08-12](https://advisories.ncsc.nl/2026/ncsc-2026-0280.html)), and CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-08-18 ([CISA KEV catalog, 2026-08-18](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)). The daemon behind the service, `screensharingd`, runs as root, so an attacker who gets in through the flaw is not confined to one account ([Calif, 2026-08-10](https://blog.calif.io/p/no-country-for-old-passwords)). Calif says the flaw needs a valid account name, which macOS prints on the login window ([Calif, 2026-08-10](https://blog.calif.io/p/no-country-for-old-passwords)). In the bypass Huntress analysed, root file read and write reaches code execution through a launch daemon that runs a reverse shell at reboot or a modified shell startup file ([Huntress, 2026-08-07](https://www.huntress.com/blog/macos-screen-sharing-rce-patched)). One week before the fix, macOS reverse-engineer fG! described a pre-authentication defect in the same daemon that lets an unauthenticated caller "download any file from a vulnerable macOS machine", and said Apple had fixed it under a denial-of-service entry in the preceding bulletin ([fG!, 2026-07-29](https://reverse.put.as/2026/07/29/its-a-pre-auth-stupid/)), a characterisation Apple has not endorsed. **Contradiction:** Huntress says fG!'s proof-of-concept is tracked as CVE-2026-65400 and roots the bypass in a frame-length check in the Secure Remote Password code that returns a stale success status ([Huntress, 2026-08-07](https://www.huntress.com/blog/macos-screen-sharing-rce-patched)). Calif says that stale-return flaw is fG!'s earlier bug, fixed in macOS 26.6 without a CVE, and that CVE-2026-65400 is a separate state-machine desync that needs a valid account name ([Calif, 2026-08-10](https://blog.calif.io/p/no-country-for-old-passwords)). **Exposure:** Macs below macOS Tahoe 26.6.1, Sequoia 15.7.9 or Sonoma 14.8.9 with Screen Sharing enabled and reachable, above all from the internet on port 5900, where NCSC-NL's confirmed cases were ([NCSC-NL, 2026-08-12](https://advisories.ncsc.nl/2026/ncsc-2026-0280.html)). Removing allowed accounts, disabling legacy VNC password authentication or rotating the VNC password does not help, and hosted bare-metal Macs commonly come provisioned with Screen Sharing enabled ([Huntress, 2026-08-07](https://www.huntress.com/blog/macos-screen-sharing-rce-patched)). **Detection:** in Apple's Endpoint Security screen-sharing attach events, Huntress reports that sessions established through the bypass it analysed carry the authentication type SRP rather than the RSA-SRP of a legitimate session, and that a session username of root, or null during account guessing, is a further signal ([Huntress, 2026-08-07](https://www.huntress.com/blog/macos-screen-sharing-rce-patched)). After patching, check hosts that were reachable for new launch daemons and modified shell startup files ([Huntress, 2026-08-07](https://www.huntress.com/blog/macos-screen-sharing-rce-patched)), and for sustained high-CPU processes, the miner outcome NCSC-NL reports ([NCSC-NL, 2026-08-12](https://advisories.ncsc.nl/2026/ncsc-2026-0280.html)). **Triage:** in the bypass Huntress analysed, a legitimate administrative session authenticates over the encrypted RSA-SRP path as a named account, while a session established through the bug carries the SRP type. Huntress calls a root session user a suspicious indicator, because that account is disabled by default and few administrators would enable it and use it for Screen Sharing, and a null user appears when an attacker guesses at account names ([Huntress, 2026-08-07](https://www.huntress.com/blog/macos-screen-sharing-rce-patched)). Calif withholds the details of the flaw it identifies as CVE-2026-65400, so whether that path leaves the same trace is not public ([Calif, 2026-08-10](https://blog.calif.io/p/no-country-for-old-passwords)). **Defender takeaway:** patch to macOS 26.6.1, 15.7.9 or 14.8.9 and turn Screen Sharing off wherever it is not needed ([BleepingComputer, 2026-08-14](https://www.bleepingcomputer.com/news/security/hackers-exploit-macos-screen-sharing-flaw-to-deploy-monero-miner/)). Treat any Mac that answered Screen Sharing from the internet before patching as possibly compromised and run the post-patch checks above. ## Update — 2026-08-11T04:45:00Z Apple's advisory says an attacker on the network may be able to authenticate to Screen Sharing without valid credentials. Three things published since change what a defender should do about it. **It is remote root, and the exploit is a weekend's work.** Calif pulled the 26.6 and 26.6.1 binaries, diffed them, and had a working exploit against a live 26.6 machine about four hours later ([Calif, 2026-08-10](https://blog.calif.io/p/no-country-for-old-passwords)). The severity is higher than the advisory line implies because `screensharingd`, the daemon answering those connections, runs as root — so an attacker does not land in the account they authenticated as, but can reach every account on the machine and install what they like. Huntress, analysing the same patch independently, describes the result as arbitrary file read and write as root, reached through the daemon's privileged file-copy helper processes, and lists code execution through a launch daemon that runs an on-disk reverse shell at reboot or a modified shell startup file that fires when a terminal is opened ([Huntress, 2026-08-07](https://www.huntress.com/blog/macos-screen-sharing-rce-patched)). Huntress also notes that an earlier public proof-of-concept's cron-based path did *not* work as implemented, because the cron location it wrote to is protected, and that its author later scoped that path to systems with System Integrity Protection disabled. The launch-daemon and shell-startup paths are not limited that way. **There were two pre-auth bugs, not one, and only one got a CVE.** Calif reports that `screensharingd` carried two independent critical flaws sitting in the same source file. The first was found by the researcher fG! (@osxreverser), never reported to Apple, and killed by Apple in the 26.6 release of 2026-07-27 alongside less severe reported bugs; it has no CVE to this day, and none of the three Screen Sharing entries in that July advisory was described as pre-authentication ([Calif, 2026-08-10](https://blog.calif.io/p/no-country-for-old-passwords)). Calif characterises that first bug as a single wrong return — a length check bailing out early on an oversized frame and handing back the success code from the preceding read, which the caller reads as an authentication step having passed. The second bug is CVE-2026-65400, fixed out of band on 2026-08-06, and Calif states it needs one thing the first did not: a valid account *name*, which is not a secret because macOS prints usernames on the login window. Both, in Calif's account, are pure logic errors: no heap grooming, no address-space defeat, no race to win, and no crash — one or two packets in the right order. **The two accounts of the root cause do not agree, and the difference is worth knowing.** Huntress roots CVE-2026-65400 in the Secure Remote Password implementation, stating that the daemon's frame-length validator erroneously returns a stale success status so the connection is treated as authenticated, and that the session then continues without cryptographic protection ([Huntress, 2026-08-07](https://www.huntress.com/blog/macos-screen-sharing-rce-patched)). Calif assigns that same stale-return mechanism to the *first*, uncredited bug, and says CVE-2026-65400 is instead a state-machine desync whose details it is withholding until more machines have updated ([Calif, 2026-08-10](https://blog.calif.io/p/no-country-for-old-passwords)). The practical consequence of the disagreement is a defensive one: a reader who has only seen the Huntress write-up may conclude the mechanism is fully public, when the more granular account says the mechanism behind the CVE that is actually patched this month has not been published. **Exposure.** Calif cites the scan by the researcher who started the affair, which found around 40,000 Macs with Screen Sharing reachable from the internet, mostly residential addresses but including university and company hosts ([Calif, 2026-08-10](https://blog.calif.io/p/no-country-for-old-passwords)). Huntress reports a separate concern for managed estates: providers of hosted bare-metal Macs commonly provision these services enabled, a search of internet-wide scan data shows tens of thousands of potentially vulnerable hosts, and at the time of writing some providers had not folded the latest updates into their base images, so newly provisioned hosts were still coming up on the previous, vulnerable version ([Huntress, 2026-08-07](https://www.huntress.com/blog/macos-screen-sharing-rce-patched)). **Detection.** Huntress describes a telemetry-level discriminator drawn from Apple's Endpoint Security event stream. On a screen-sharing attach event, a legitimate authenticated session reports its authentication type as `RSA-SRP`, while a session established through this bug reports the weaker `SRP` value, because no cryptography is applied to it. The session username is the second signal: `root` is a suspicious indicator, since that account is disabled by default on macOS and few administrators would enable it and then use it for Screen Sharing, and an attacker guessing at account names produces attach events with a null session username, noisy enumeration that is itself worth alerting on. At the process layer, execution of the daemon's file-copy sender helper with a user and group identifier of 0 and 80 accompanies information-disclosure attempts, though Huntress notes those values do not stay static once the attacker enumerates another local account. **Triage:** Screen Sharing is a real administrative tool, so the session itself is not the signal — the authentication type is. Huntress ties the unencrypted variant to sessions established through the bug and calls a `root` session username a suspicious indicator that few administrators would produce, while an ordinary remote-support session by an administrator authenticates over the encrypted path as a named account ([Huntress, 2026-08-07](https://www.huntress.com/blog/macos-screen-sharing-rce-patched)). Where that telemetry is unavailable, the fallback discriminator is exposure rather than behaviour: a Screen Sharing listener answering from an untrusted network at all is the condition this bug needs. ## Update — 2026-08-16T04:50:00Z CVE-2026-65400 is now confirmed to be exploited. The Dutch national cyber security centre revised advisory NCSC-2026-0280 on 2026-08-12 to state that it had received a notification showing active abuse of the vulnerability observed on multiple systems where port 5900 was reachable from the internet, and that in all of those cases root access was obtained on the affected system and a Monero cryptocurrency miner was planted ([NCSC-NL, 2026-08-12](https://advisories.ncsc.nl/2026/ncsc-2026-0280.html)). The advisory's revision note for that version records that public proof-of-concept code is available and active abuse is known ([NCSC-NL, 2026-08-12](https://advisories.ncsc.nl/2026/ncsc-2026-0280.html)). The confirmed cases fall in the exposed population set out on 2026-08-11: Macs with Screen Sharing reachable from the internet on port 5900. Two things are worth holding steady against the temptation to escalate further. The reported outcome is a planted Monero miner, and NCSC-NL has not said whether the attacks went beyond it ([BleepingComputer, 2026-08-14](https://www.bleepingcomputer.com/news/security/hackers-exploit-macos-screen-sharing-flaw-to-deploy-monero-miner/)). That reflects what these attackers did, not what the primitive permits, since the same pre-auth root gets an operator anything they want on the host. And the remediation has not changed: the fixed builds are macOS 26.6.1, Sequoia 15.7.9 and Sonoma 14.8.9, the same ones named on 2026-08-08 ([BleepingComputer, 2026-08-14](https://www.bleepingcomputer.com/news/security/hackers-exploit-macos-screen-sharing-flaw-to-deploy-monero-miner/)). Where an update cannot be applied immediately, disabling Screen Sharing in System Settings where it is not needed remains the vendor-path control ([BleepingComputer, 2026-08-14](https://www.bleepingcomputer.com/news/security/hackers-exploit-macos-screen-sharing-flaw-to-deploy-monero-miner/)). Detection: NCSC-NL has not shared details of the attacks beyond root access and a planted miner, so it has published no miner process name, pool infrastructure or persistence mechanism ([BleepingComputer, 2026-08-14](https://www.bleepingcomputer.com/news/security/hackers-exploit-macos-screen-sharing-flaw-to-deploy-monero-miner/)). No source says whether the confirmed cases showed the authentication-type and session-user discriminator Huntress described for the bypass it analysed ([Huntress, 2026-08-07](https://www.huntress.com/blog/macos-screen-sharing-rce-patched)). The confirmed cases ended with a Monero miner planted after root access ([NCSC-NL, 2026-08-12](https://advisories.ncsc.nl/2026/ncsc-2026-0280.html)), so sustained high processor load on a host that accepted connections on 5900 is worth checking. **Triage:** Screen Sharing sessions are ordinary on managed Mac fleets, and remote-support tooling produces them all day. The separators are reachability and identity rather than the connection itself: a session sourced from outside the corporate network to a host whose 5900 listener is internet-facing, and, in the bypass Huntress analysed, a session whose user is root or null ([Huntress, 2026-08-07](https://www.huntress.com/blog/macos-screen-sharing-rce-patched)). Legitimate administrative screen sharing arrives from known internal ranges or a VPN concentrator and binds to a real operator identity. The confirmed cases were on hosts whose port 5900 was reachable from the internet ([NCSC-NL, 2026-08-12](https://advisories.ncsc.nl/2026/ncsc-2026-0280.html)). ## Correction — 2026-09-30T06:44:45Z The earlier summary said no exploitation was reported, and the main text said Apple reported none. NCSC-NL revised its advisory on 2026-08-12 to report active abuse ([NCSC-NL, 2026-08-12](https://advisories.ncsc.nl/2026/ncsc-2026-0280.html)) and CISA added CVE-2026-65400 to its Known Exploited Vulnerabilities catalog on 2026-08-18 ([CISA KEV catalog, 2026-08-18](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)). The main analysis also called the flaw a straightforward patch item with no artifact beyond a normal-looking session. The daemon runs as root ([Calif, 2026-08-10](https://blog.calif.io/p/no-country-for-old-passwords)), and for the bypass it analysed Huntress documents an authentication-type and session-user discriminator and the persistence paths to check after patching ([Huntress, 2026-08-07](https://www.huntress.com/blog/macos-screen-sharing-rce-patched)). The 2026-08-16 text said the confirmed cases matched that discriminator and ran a process with no user session, which no source reports: NCSC-NL shared no details beyond root access and a planted miner ([BleepingComputer, 2026-08-14](https://www.bleepingcomputer.com/news/security/hackers-exploit-macos-screen-sharing-flaw-to-deploy-monero-miner/)). The same text called the outcome cryptomining rather than data theft or ransomware, but NCSC-NL has not said whether the attacks went beyond the miner ([BleepingComputer, 2026-08-14](https://www.bleepingcomputer.com/news/security/hackers-exploit-macos-screen-sharing-flaw-to-deploy-monero-miner/)). The 2026-08-11 text said an attach with the unencrypted authentication type or a root or null session user has no benign explanation on a managed Mac and called a root user a strong indicator. Huntress calls a root session user a suspicious indicator, since few administrators would enable that account and use it for Screen Sharing ([Huntress, 2026-08-07](https://www.huntress.com/blog/macos-screen-sharing-rce-patched)). No cited source mentions Screen Sharing being discoverable over mDNS. The do-now steps are to patch and disable or firewall Screen Sharing, then to check every Mac that was reachable from the internet before patching.