Researchers Push Over 2 Million Updates to Remotely Disable Popcorn Time Updater That Could Fuel a Botnet

Summary: Between November 2025 and March 2026, Dutch security firm Eye Security pushed more than 2 million updates to machines it did not own, disabling a background updater in Time4Popcorn, an abandoned copy of the Popcorn Time streaming app, that checked for new versions over an unencrypted connection and installed whatever it was sent at SYSTEM or root privilege without verifying the sender. Eye found the updater during a routine threat hunt after a client's Updater.exe kept calling an unregistered address; registering it drew about 50 requests a second and more than 3.8 million distinct hardware IDs, which the firm revised to an estimate of 2.5 to 3 million Windows computers and 250,000 to 350,000 Macs, and the flaw is tracked as CVE-2026-30612 with a CISA severity rating of 9.8 out of 10.
Why it matters: Anyone who registered one of the abandoned addresses the updater called could have served ransomware, stolen saved passwords, or pulled the machine into a botnet, and Eye's mapping saw connecting machines on government, military, and corporate networks. Three of the 20 domains in Eye's write-up were never its to take and remain with outside owners, so machines that reach those are still exposed.

Read the original at The Hacker News ↗

Mentions: CVE-2026-30612