Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilityhigh

Eye Security disabled a hijackable Popcorn Time updater on millions of PCs

4 sources · 4 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Eye Security seized abandoned Time4Popcorn updater domains, pushed a disabling update to more than two million systems, and handed 15 domains to Shadowserver.

Time4Popcorn, a Popcorn Time fork abandoned after 2014, left an unauthenticated updater that fetched unsigned executables over HTTP and could run them as SYSTEM or root. CVE-2026-30612, scored 9.8 by CISA, affects Windows builds through 6.2.1.18, Mac builds through 6.2.1.17, and Android builds through 3.5.0.173. Between November 2025 and March 2026, Eye Security registered abandoned updater domains and served more than two million updates that only stopped and disabled the desktop updater. Eye estimated 2.5 to 3 million Windows PCs and 250,000 to 350,000 Macs; SecurityWeek also cites under 200,000 Android clients, including government, military, and corporate networks. Eye stopped around March 1 after traffic fell about 98 percent, then transferred 15 domains to Shadowserver. Other domains remain with outside owners, there is no vendor patch, and Android was not remotely disabled.

Key facts
  • CVE-2026-30612 scored 9.8 and was not in CISA’s KEV catalog as of October 23.
  • Windows through 6.2.1.18, Mac through 6.2.1.17, and Android through 3.5.0.173 are affected.
  • By December 2025 Eye had updated more than 1 million systems and cut traffic about 90 percent.
  • By March traffic was about 5,000 updates a day, down roughly 98 percent.
  • Android’s updater cannot be disabled alone, so Eye sent no Android updates.
  • Eye advises uninstalling the app; the updater can also be disabled manually.
Analyze CVE-2026-30612 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first
  1. Mar 1, 2026Eye stopped after updater traffic fell about 98 percent. · The Hacker News
  2. Oct 23, 2026CVE-2026-30612 was not listed in CISA’s KEV catalog. · The Hacker News

What each outlet adds

beyond the shared facts
  • The Hacker NewsVersion bounds, CISA 9.8 score, December milestone, and daily volume.
  • Malwarebytes LabsNames Windows and macOS updater components and the unsigned HTTP fetch.
  • SecurityWeekNames popcorntimeupd.xyz and government, military, and corporate connections.
  • Dark ReadingCalls the exposed names dropcatch domains and notes no vendor patch.
CVEs
CVE-2026-30612
Products
Time4PopcornPopcorn Time
Organizations
Eye SecurityShadowserver FoundationCISAThe Shadowserver Foundation

Coverage

oldest first · one row per article · UTC
  1. · 6d ago The Hacker NewsFirst report

    Eye Security pushed 2 million updates to disable Popcorn Time updater

    CVE-2026-30612, scored 9.8, let anyone owning abandoned updater domains push code as SYSTEM or root.

  2. · 4d ago Malwarebytes Labs

    Abandoned Popcorn Time updater could hijack PCs via CVE-2026-30612

    Eye Security seized update domains, pushed a disabling fix with over two million downloads, then gave 15 domains to Shadowserver.

  3. · 3d ago SecurityWeek

    Abandoned Popcorn Time updater risked takeover of millions of PCs

    Eye Security sinkholed updater domains and pushed a disabling update to about 2 million Windows and macOS systems.

  4. · 12h ago Dark Reading

    Abandoned Time4Popcorn updater still runs on millions of machines

    Eye Security says it still checks abandoned domains on more than 2.5 million Windows PCs and about 300,000 Macs.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-30612
Remote code execution in Time4 Popcorn updater components (Windows, macOS, Android)
9.8<1%