Three million PCs were one domain registration away from a botnet

Start with the detail that gave it away. A laptop at one of Eye Security's clients kept running something called Updater.exe, and Updater.exe kept trying to reach a web address that nobody owned any more. Expired domains are cheap. Whoever registers one next gets to answer for it.

So they registered it, popcorntimeupd.xyz, and watched what arrived: roughly 50 check-ins a second from all over the world. The software doing the asking was Time4Popcorn, a fork of the old Popcorn Time film client, abandoned years ago and still sitting on an enormous number of machines. Its updater fetched files over plain HTTP and ran whatever came back without checking a signature, as SYSTEM on Windows and root on Mac. Over six months Eye logged more than 3.8 million hardware IDs, which it puts at 2.5 to 3 million Windows PCs and up to 350,000 Macs. Mostly home broadband, but corporate, government and military networks too.

What they did with that is the part worth telling. Between November 2025 and March 2026 they used the hole to close it, pushing more than two million updates whose only job was to stop and disable the updater. Nothing was deleted, no telemetry collected. Check-ins fell 90 percent within weeks and 98 percent by 1 March, and the fifteen domains now belong to the Shadowserver Foundation. The flaw is CVE-2026-30612 and the write-up went out on 22 October.

If any Popcorn Time build is still installed on a machine in your house, uninstall it rather than leaving it. The updater is handled; the application is not. It bundles a 2014 copy of Chrome with the sandbox switched off and pulls everything over unencrypted connections. Android copies could not be fixed remotely at all. Tendvane's Safety check is built for exactly this sort of thing: old software you forgot was there, still running in the background.