Abandoned Time4Popcorn app could have infected millions via updates

Eye Security found CVE-2026-30612 (9.8/10) in the abandoned Time4Popcorn torrent client, which fetched executables over HTTP from the defunct popcorntimeupd.xyz domain without signature checks. After registering the domain, researchers safely disabled the updater on roughly 3 million Windows and 350,000 macOS devices, including government and military networks.

• CVE-2026-30612 was rated 9.8 out of 10 in severity
• Up to 3 million Windows and 350,000 macOS clients connected to the update domain
• The updater was disabled between November 2025 and March 2026
• Update-domain requests fell 98%, but Android devices remain at risk