Researchers Push 2 Million Updates to Disable Vulnerable Time4Popcorn Updater
Vulnerability Disclosure · 3 sources · Updated 2h ago · First seen Oct 24, 2026
Eye Security distributed more than 2 million updates to disable a vulnerable updater in the abandoned Time4Popcorn application, averting a potential route to a large-scale botnet. The flaw, CVE-2026-30612, allows anyone controlling the application's update domains to distribute arbitrary code with SYSTEM privileges on Windows or root privileges on macOS. Eye estimated that 2.5–3 million Windows computers and 250,000–350,000 Macs were exposed; The Hacker News reported a CISA severity rating of 9.8 out of 10.
Under Operation IXIM, Eye delivered the disabling updates between November 2025 and March 2026, then transferred 15 controlled domains to the Shadowserver Foundation. Researchers found no evidence of malicious exploitation through the update domains, but some domains remain under outside ownership, leaving machines contacting them exposed. Disabling the updater does not address the application's other security weaknesses; organizations should identify and uninstall Time4Popcorn rather than treat the intervention as a complete remediation.
