Overview
- A background updater in a defunct Popcorn Time fork used unencrypted HTTP and accepted unsigned executables, a flaw tracked as CVE-2026-30612 that could let an attacker run code on Windows and macOS systems.
- Eye Security legally registered abandoned update domains and pushed a benign update that stopped the updater, and the company later handed control of those domains to the Shadowserver Foundation.
- By March 2026 the researchers reported more than two million installs of their updater-disabling fix and roughly a 98% drop in update requests to the domains they controlled.
- Eye Security estimates roughly 2.5–3 million Windows PCs and 250,000–350,000 Macs showed the vulnerable updater, and Android installs remain harder to remediate because the APK installer requires user approval.
- The episode shows how orphaned software and insecure updaters create large supply-chain risks and raises questions about the limits and legality of third-party remediation, so users should uninstall Popcorn Time and check for leftover background updaters.