TL;DR

what: Between November 2025 and March 2026, Eye Security used the Time4Popcorn updater's own flaw to push more than 2 million updates that disabled it on machines the firm did not own.

impact: An estimated 2.5 to 3 million Windows PCs and 250,000 to 350,000 Macs ran an updater that would install any code at SYSTEM or root level from abandoned domains anyone could register.

fix: CVE-2026-30612 has no vendor and no patch, so Eye sinkholed 15 domains through the Shadowserver Foundation and recommends uninstalling Time4Popcorn entirely.

who: Anyone still running Time4Popcorn on Windows up to 6.2.1.18, Mac up to 6.2.1.17 or Android up to 3.5.0.173, including some machines on government, military and corporate networks.

Between November 2025 and March 2026, the Dutch security firm Eye Security pushed more than 2 million updates to computers it did not own.…