Report
Eye Security remotely disabled vulnerable Time4Popcorn updaters on Windows and macOS
The Verge, citing Eye Security, says controlling an abandoned update domain could have let attackers install software with full privileges.
TLDR
The Verge and BleepingComputer, citing Eye Security, report that the firm registered abandoned Time4Popcorn domains and sent an update to disable vulnerable updaters on Windows and macOS. Someone controlling an update domain could have installed software with elevated privileges. Eye Security said it sent over 2 million update downloads by March 2026. Android updaters were not remotely disabled because installing the update would require user interaction.
Combined views
13.4K
2 Sources, first seen ago