Between November 2025 and March 2026, Eye Security pushed over 2 million updates to computers it did not own to disable an abandoned background updater from Time4Popcorn.
Tracked as CVE-2026-30612 with a CISA rating of 9.8, the affected base included millions of Windows and Mac systems running high-privilege unencrypted connections.
Eye handed the web addresses to Shadowserver.