Eye Research’s October 22 report describes disabling vulnerable Windows and macOS updaters in the abandoned Time4Popcorn application between November 2025 and March 2026. The researchers say its update process accepted unsigned code over HTTP with elevated privileges. They associate the flaw with CVE-2026-30612.
The team reports more than two million update downloads, not a verified count of unique protected devices. Its intervention left the application itself unchanged and did not update Android installations. Eye recommends removing the old software and explicitly excludes the newer legal Popcorn Time project from this research.
NAOAT analysis
The operational lesson is that application use and software presence are different inventory questions. Asking employees what they use will not reliably reveal a background component left by an installation years earlier. A retirement process should account for services, scheduled tasks and update mechanisms as well as the visible application shortcut.
For a company reviewing its endpoints, a useful record would connect each installed program to an owner and a current purpose. Where neither exists, the next step is a managed review of removal and dependencies. Simply blocking one destination may leave the underlying component present, making it harder for a future administrator to understand whether the software was deliberately retained or merely overlooked.
The account also illustrates why intervention results need careful labels. A download count describes an event; it cannot, on its own, prove how many distinct devices changed state or whether each remains secure. A company carrying out its own cleanup should verify the resulting endpoint condition and keep exceptions visible. That approach turns a cleanup campaign into an auditable maintenance task. The article is a retrospective account of researchers’ actions, not a recommendation that businesses use another party’s update infrastructure to change systems they do not manage.