The fact that this has been out there in the wild for weeks (and apparently exploitable via Apple Remote Desktop, too) is amazing, and further damning evidence that Apple’s QA has been slipping beneath any sort of tolerable threshold.
The scheduled release approach (whereby software is shipped in lockstep with increasingly predictable hardware launches) has been steadily eroding quality across the board (and iOS 11.0 was a great example of that), but macOS seems to be falling into full-fledged neglect, and as a primarily UNIX user, I’m flabbergasted this kind of thing is even possible in 2017.
Good thing that I have great options, including (surprisingly enough) the ability to work sanely in Windows.
Update: Well, that was quick. Here’s the KB article for the mandatory update that’s been issued to fix this (well, almost), and… Here’s how to fix file sharing if the update breaks it for you, which is utterly ridiculous.