RESEARCHERS PUSH OVER 2 MILLION UPDATES TO REMOTELY DISABLE POPCORN TIME UPDATER THAT COULD FUEL A BOTNET

Summary from the TLDR InfoSec newsletter

Eye Security pushed more than 2 million updates to disable an abandoned Time4Popcorn updater that installed code with SYSTEM or root privileges over unencrypted connections. The flaw, CVE-2026-30612, affected Windows, Mac, and Android builds. The updates cut related traffic by about 98 percent, and Eye then transferred 15 domains to Shadowserver. Users should uninstall Popcorn Time. Turning off the updater leaves the insecure application installed.