Eye Security Disables Insecure Popcorn Time Updater on Millions of Devices

Eye Security registered abandoned Time4Popcorn update domains and pushed a fix disabling the vulnerable updater tracked as CVE-2026-30612. The domains saw 2.5–3 million Windows systems, 250,000–350,000 macOS and under 200,000 Android devices; about 2 million received the fix.

• Updater fetched and ran unsigned executables over plain HTTP at boot
• Domains saw 2.5–3M Windows, 250–350K macOS and under 200K Android systems
• By March 2026 the fix reached ~2M systems, cutting update requests by 98%
• On Android the updater is embedded in the app and cannot be disabled remotely