Eye Security disables Popcorn Time updater on millions of machines to block possible botnet
The remote fix stops the flaw for now, but the rest of the abandoned app remains insecure and users are advised to uninstall it.
Between November 2025 and March 2026, Dutch firm Eye Security remotely pushed more than two million patches to Windows and Mac machines running an abandoned Popcorn Time copy, switching off its updater that could have let an outsider install code at the highest privilege level. The flaw, tracked as CVE-2026-30612 and rated 9.8 by CISA, affected a Time4Popcorn updater that checked for updates over an unencrypted connection and accepted whatever it was sent. Eye estimated roughly 2.5 to 3 million Windows computers and 250,000 to 350,000 Macs were exposed, and it handed the 15 web addresses it controlled to the Shadowserver Foundation in late March. The rest of the app remains insecure, so the firm advises users to uninstall it, and Android devices were not affected by the remote update since they require user acceptance.
Why it matters
For users of this abandoned Popcorn Time copy, the risk did not depend on anything they chose to install: an updater that accepted unverified code at the highest privilege level could have been used to take control of their machines. The remote update removed that path on millions of Windows and Mac computers, but it did not fix the app itself, so those who keep it are still exposed. Android devices were outside the remote update because they require user acceptance, which means the two platforms face different levels of exposure. Readers should understand that the disabled updater is a stopgap and that removal is the only full answer.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.