Overview
- Eye Security registered abandoned update domains and, between November 2025 and March 2026, pushed a disabling update that was downloaded by more than two million clients to stop the background updater.
- The flaw, tracked as CVE-2026-30612, let the updater fetch executables over unencrypted HTTP and run them without verifying signatures, creating a path for remote code execution with SYSTEM privileges on Windows and root on macOS.
- Researchers estimated roughly 2.5–3 million Windows systems and 250,000–350,000 Macs still contacted the update servers, and their intervention cut requests to the controlled domains by about 98% before handing those domains to the Shadowserver Foundation.
- Eye Security said it sought legal advice, built a payload that collected no telemetry or deleted no files, and had to modify that payload after antivirus engines flagged it when it was uploaded to VirusTotal.
- Risks remain because Android clients could not be remotely disabled, some update domains are still out of trusted control, and the Popcorn Time app uses an unsandboxed 2014 browser engine so users are advised to uninstall the app and defenders should look for known updater files and domain traffic.