Eye Security pushed over 2 million updates to unowned Windows and Mac systems between November 2025 and March 2026 to disable an abandoned background updater running at high privilege over unencrypted connections.
Tracked as CVE-2026-30612, the issue affected millions of installations before control was handed to the Shadowserver Foundation.
How they all started
The story began when the Dutch company noticed something unusual on a client computer. A program running in the background was constantly trying to contact an address on the Internet that no longer existed. The company decided to register this address itself to see what was happening. Within a short time, about fifty requests per second began to arrive.
The move came from the automatic update system of an old app called Popcorn Time. Although the original app was shut down in 2014, various clones had been released since then. The updater ran silently from the moment the computer was turned on, connecting without any protection and being able to install whatever was sent to it, giving it full access to the system.
A huge risk for millions of users
Because the address the program was addressing had been abandoned, anyone could claim it and send their own program to any computer waiting for an update. This could lead to the theft of personal passwords, locking files, or even the computers being included in a vast network of controlled devices.
READ ALSO
Diplomatic services in three countries were subjected to a digital attack by a group linked to China
Experts estimated that the number of devices attempting to connect was between 2,5 million and 3 million on Windows computers and 250.000 and 350.000 on Macs. The issue affected Windows up to version 6.2.1.18, Mac up to version 6.2.1.17, and Android up to version 3.5.0.173.
The company's intervention
Since there was no company behind the application to fix the problem, the researchers decided to take action themselves. After legal advice, they created their own update and gradually sent it to more than two million computers. This file did not delete any files or collect any data, but did only one thing: stop and disable the dangerous updater.
This process lasted from November 2025 to March 2026. The Dutch company then handed over the 15 addresses it had registered to a non-profit foundation, the Shadowserver Foundation, so that they could be managed by a trusted organization.
What should those who had the application do?
Disabling the updater does not make the rest of the application safe. The program itself works with old technologies and remains dangerous for anyone who continues to use it. The best solution, according to experts, is to completely remove the application from the computer or mobile phone.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
Top comments (0)