In the spirit of transparency as our core value we are disclosing the internal infrastructure team postmortem for this event to show our commitment to security.
Summary
On 2026/09/04 four Jenkins CI hosts were found to be compromised using CVE-2026-65400 in order to run a Monero miner process.
The CVE allowed for authentication to Screen Sharing without valid credentials via an open VNC port. The investigation revealed the hosts were compromised on 2026-08-08. The only changes found on the hosts were related to the miner binary, SSH access, and process persistence via Launchd config files.
Investigation has found no evidence of tampering with Status build tooling. No Status official releases were built on the hosts between 2026-08-08 and 2026-09-04. Last stable release was 2.38.2 from 2026-07-21, which is definitely not affected.
Timeline (UTC)
- 05:00 - Infra engineer detects unusually high CPU load on
macm1-01host. - 05:11 - CI hosts taken offline and isolated for investigation.
- 05:20 - Presence of
/private/var/root/.config/sysmondprocess discovered. - 06:24 - Most probable source identified as CVE-2026-65400 affecting macOS 26.4.1
- 07:07 - Status Program Lead is informed about situation and need to delay any releases.
- 07:29 - Infra engineers begin reinstalling 3 our of 4 affected CI hosts.
- 08:32 - Initial investigation shows no changes to build tooling.
- 09:30 - Adjustments to firewall rules are made to patch VNC access.
- 12:48 - Consul agent secrets identified as potentially compromised.
- 14:03 - Rotation of all affected Consul API tokens completed.
Details
Investigation
All four affected hosts were found to exhibit persistent higher CPU usage, but not so high that it triggered alerts:
The process in question was an instance of /private/var/root/.config/sysmond:
> ps aux | grep airportd
root 419 397.5 12.8 444661696 2149984 ?? Rs 24Aug26 54701:07.50 com.apple.airportd -o auto.c3pool.org:443 -u 4AUZ9XNsffcPn13Yjk5yWAaZg8x5Fgu9cL9kWwDCnmACUFLuwrLg41WU31qiKfmo9ee62mVbwG9F5G82Ko8vck8nCtxdicj -p x -t 4 --randomx-no-rdmsr --no-color --log-file=/var/root/.config/sysmond.log
Ran via Launchd plist definition under /Library/LaunchDaemons/com.xmr.miner.plist and obscured using exec -a com.apple.airportd to masquerade the miner process as legitimate Apple process com.apple.airportd.
Processes were checked for open file and socket access and stopped afterwards.
sysmond 34238 cwd DIR 1,13 704 2 /
sysmond 34238 txt REG 1,13 72744 154105 /Library/Preferences/Logging/.plist-cache.lazt2wCx
sysmond 34238 txt REG 1,13 7349568 92832558 /private/var/root/.config/sysmond
sysmond 34238 1u REG 1,13 22730455 92832561 /private/var/root/.config/sysmond.log
sysmond 34238 2u REG 1,13 22730455 92832561 /private/var/root/.config/sysmond.log
sysmond 34238 9w REG 1,13 22730455 92832561 /private/var/root/.config/sysmond.log
sysmond 34238 11u unix 0x2241668d1532c02 0t0 ->0x990d4d7b9550d240
sysmond 34238 13u IPv4 0xa79db76b14b56165 0t0 TCP 185.181.230.75:62968->57.129.119.218:443 (ESTABLISHED)
sysmond 34238 14u systm 0xcc9246056e0cd624 0t0 [ctl com.apple.netsrc id 10 unit 51]
sysmond 36631 txt REG 1,13 175712 1152921500312575032 /usr/libexec/sysmond
sysmond 34238 txt REG 1,13 2357376 1152921500312572606 /usr/lib/dyld
sysmond 36631 txt REG 1,13 2357376 1152921500312572606 /usr/lib/dyld
No access to files beyond its own logs, config file, standard dynamic linker, and network connection was found.
Impact
The release CI host affected was investigated for changes closely. Both System Integrity protection and Authenticated Root was found to be enabled:
> csrutil status
System Integrity Protection status: enabled.
> csrutil authenticated-root status
Authenticated Root status: enabled
And root volume was mounted from a sealed snapshot disk3s1s1:
> diskutil apfs list
...
| | APFS Volume Disk (Role): disk3s1 (System)
| | Mount Point: /System/Volumes/Update/mnt1
| | Capacity Consumed: 17247371264 B (17.2 GB)
| | Sealed: Broken
...
| | Snapshot Disk: disk3s1s1
| | Snapshot Mount Point: /
| | Snapshot Sealed: Yes
The presence of /System/Volumes/Update/mnt mount is explained by macOS update service:
% pgrep -alf softwareupdated
394 /System/Library/CoreServices/Software Update.app/Contents/Resources/softwareupdated
Build Tooling
Most of our build tools are installed via nix-darwin and /run/current-system was compared against an uncompromised CI machine where no differences were found:
attacked-host > nix path-info --recursive /run/current-system | sort | md5sum
7209fe997a7c61bf9ee32e2a977add13 -
uncompromised-host > nix path-info --recursive /run/current-system | sort | md5sum
7209fe997a7c61bf9ee32e2a977add13 -
Checks against the contents of /nix/store entries also showed no changes.
Similar comparison was done for our Qt 6.11.0 installation:
> sudo find $QTDIR -type f -exec shasum -a 256 {} + | LC_ALL=C sort | md5sum
c7f9bda0926bab8259d923f79a885cdf -
And showed no differences.
Checks of other locations like Homebrew installation folder - not used in Status builds - also showed no tampering.
Full hashes of contents the hosts being compared are available under files/20260904_ci_macos_attack.
> cd files/20260904_ci_macos_attack/macm2-01-release
> find . -type f
./logs/system_profile.log
./logs/ps_auxww.log
./logs/launchctl_print_system.log
./logs/kmutil_showloaded.log
./logs/system_integrity.log
./logs/lsof_nP.log
./hashes/qt.md5
./hashes/launchd.md5
./hashes/nix.md5
./hashes/nbs.md5
Affected Builds
Although no build tooling tampering has being found and no official stable releases came out in the intervening time some builds are considered suspect.
While the macOS CI hosts were compromised there were five release candidate macOS and iOS builds - from 2.39.0-rc.1 to 2.39.0-rc.5 - which have been deleted from GitHub and our storage as potentially tampered.
The full list of potentially affected builds is in files/20260904_ci_macos_attack/affected_release_candidates.list.
Identified Errors
- Running outdated by 5 months macOS Tahoe 26.4.1 release permitted the exploit.
- Firewall configuration allowed non-VPN access to VNC Remote Desktop port.
- Lack of intrusion detection software deployed on macOS CI hosts delayed detection.
Conclusions
- Firewall adjustment to prevent VNC access beyond initial host bootstrapping phase.
- Implementation of a more sophisticated VPN setup that requires OpenID SSO authentication.
- Use a virtualisation solution to avoid running Jenkins agent on Bare Metal.
- More narrow scoping of Consul API tokens deployed to Consul agents.
- Deployment of Wazuh Agent to all CI hosts for intrusion detection.
- More regular upgrade schedule to be implemented for CI hosts.