Eye Security pushed 2 million updates to disable Popcorn Time updater
Original title: Researchers Push Over 2 Million Updates to Remotely Disable Popcorn Time Updater That Could Fuel a Botnet
CVE-2026-30612, scored 9.8, let anyone owning abandoned updater domains push code as SYSTEM or root.
Between November 2025 and March 2026, Dutch firm Eye Security registered abandoned Time4Popcorn updater domains and served more than 2 million updates that only stopped and disabled the updater. The unauthenticated updater, CVE-2026-30612, affected Windows builds through 6.2.1.18, Mac builds through 6.2.1.17, and Android builds through 3.5.0.173. Eye estimated 2.5 to 3 million Windows PCs and 250,000 to 350,000 Macs, then transferred 15 domains to Shadowserver. Other updater domains remain with outside owners, and Eye advises uninstalling the app.
Unconfirmed: Machine totals are Eye estimates because hardware IDs were unreliable, and some updater domains were never under Eye's control.
- CISA rates CVE-2026-30612 9.8; it was not in the KEV catalog as of October 23.
- By December 2025 Eye had updated more than 1 million systems and cut traffic about 90 percent.
- Eye stopped around March 1 after traffic fell about 98 percent, to roughly 5,000 updates a day.
- Android's updater cannot be disabled alone, so Eye sent no Android updates.
- Eye built a proof of concept against other abandoned content domains but did not run it.
Impact: Unsigned updates installed as SYSTEM on Windows or root on Mac
| Product | Affected |
|---|---|
| Time4Popcorn for Windows | up to and including 6.2.1.18 |
| Time4Popcorn for Mac | up to and including 6.2.1.17 |
| Time4Popcorn for Android | up to and including 3.5.0.173 |
- 1.Uninstall Popcorn Time rather than only disabling the updater.
- 2.On Windows, stop and disable the service named Update service.
- 3.On Mac, unload /Library/LaunchDaemons/PT.updd.plist.
- CVEs
- CVE-2026-30612
- Products
- Time4PopcornPopcorn Time
- Organizations
- Eye SecurityShadowserver FoundationCISA
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-30612 | Remote code execution in Time4 Popcorn updater components (Windows, macOS, Android) | 9.8 | <1% |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | popcorntimeupd.xyz | ther than Eye. Public registration records for one of them, popcorntimeupd[.]xyz, now point to Shadowserver's sinkhole servers, with a tra |
| ipv4 | 3.5.0.173 | , up to and including 6.2.1.17 Android, up to and including 3.5.0.173 Turning the Updater Against Itself With no company left to |
| ipv4 | 6.2.1.17 | dows, up to and including 6.2.1.18 Mac, up to and including 6.2.1.17 Android, up to and including 3.5.0.173 Turning the Updater |
| ipv4 | 6.2.1.18 | of the Time4Popcorn software: Windows, up to and including 6.2.1.18 Mac, up to and including 6.2.1.17 Android, up to and includ |
From the original article
5 min read at thehackernews.com
Between November 2025 and March 2026, the Dutch security firm Eye Security pushed more than 2 million updates to computers it did not own to switch off a background updater that it said could have allowed an outsider to take over the machine. The updater belongs to Time4Popcorn, an abandoned copy of Popcorn Time, a free app that streamed pirated films and TV over BitTorrent. Popcorn Time was
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.