Eye Security pushed 2 million updates to disable Popcorn Time updater
CVE-2026-30612, scored 9.8, let anyone owning abandoned updater domains push code as SYSTEM or root.
1
Stories per day · 30 days
Relatedsupply-chain4time4popcorn3updater3windows3abandoned-software2macos2sinkhole2domain-takeover1remote-code-execution1shadowserver1software-updater1
2 stories, newest first · one card per story
Stories tagged #popcorn-time
Abandoned Time4Popcorn updater allowed RCE over plain HTTP
Eye Security counted up to 3 million Windows and 350,000 macOS clients calling the domain it registered.
1