Researchers Push Over 2 Million Updates to Remotely Disable Popcorn Time Updater That Could Fuel a Botnet

Between November 2025 and March 2026, Dutch security firm Eye Security conducted Operation IXIM, pushing over 2 million updates to disable a vulnerable updater in the abandoned Time4Popcorn application, which could have been exploited to create a large-scale botnet. The updater, running with SYSTEM/root privileges, fetched updates over unencrypted connections without authentication, making it susceptible to remote code execution. The vulnerability, tracked as CVE-2026-30612, affected Windows, Mac, and Android versions of the app and allowed any actor who registered abandoned domains to push malicious payloads. Eye Security mitigated the threat by registering the domains and pushing a disabling update, later transferring control to the Shadowserver Foundation.

AI-extracted · verify before operational use