Overview
- Eye Security discovered the flaw and registered the orphaned update domains, then used the updater itself to push a minimal update that stops and disables the background updater.
- Between November 2025 and March 2026 Eye delivered more than 2 million unrequested downloads and recorded millions of devices contacting the abandoned domains, which it later transferred to the Shadowserver Foundation.
- The vulnerability, tracked as CVE-2026-30612 and rated 9.8 by CISA, let an update server supply unsigned executables over unencrypted HTTP that would install at SYSTEM level on Windows and root on macOS.
- Significant exposure remains because the Popcorn Time app still runs a 2014 browser engine with its sandbox disabled, some updater domains are still owned by others, and Android installs could not be remediated remotely.
- The episode shows a gap in handling orphaned software where private remediation can cut immediate risk but raises legal and operational questions and highlights how antivirus tools can unintentionally block benign emergency fixes.