The Hacker News disclosed that Dutch security firm Eye Security intervened to disable a dangerous background updater found in the abandoned software Time4Popcorn.
The updater, which lacked encryption and verification, allowed for remote code execution at the highest privilege levels on Windows and Mac systems. Eye Security discovered the flaw when a client laptop attempted to connect to an expired web address. By registering the domain, the firm identified millions of vulnerable devices globally, including those on government and corporate networks. To mitigate the risk of attackers hijacking these machines for ransomware or botnets, Eye Security pushed an update to over 2 million computers that stopped and disabled the vulnerable service. The vulnerability, tracked as CVE-2026-30612, received a 9.8 severity rating from the Cybersecurity and Infrastructure Security Agency. While the intervention reduced traffic by 98%, the firm emphasized that the software remains inherently insecure due to outdated components and unencrypted connections. Experts strongly advise users to uninstall the application entirely, as disabling the updater does not address the broader security risks posed by the legacy software. The firm has since transferred control of the domains to the Shadowserver Foundation to ensure ongoing protection.
Source: The Hacker News
