decrypted · 26 october 2026 · vulnerabilities and patching · supply chain · surveillance and privacy

An abandoned app's updater could have run code on millions of machines

A dead streaming app has handed the industry a tidy lesson in how software updates go wrong. Researchers at Eye Security found that Time4Popcorn, an abandoned fork of the Popcorn Time BitTorrent client, still had an updater running on a great many machines, calling home to domains nobody owned any more. Whoever registered those domains could have pushed code to all of them. Eye registered one, and then did the decent thing.

An updater that trusted a stranger

The flaw is tracked as CVE-2026-30612. On Windows and macOS the updater runs in the background with full privileges: SYSTEM on Windows, root on macOS. Eye's write-up says it connects to update servers over an insecure channel, so anyone able to manipulate that traffic can offer their own update. BleepingComputer, reporting the research, adds that the updater accepted executables without checking their digital signatures. On Android the user is prompted to install an attacker's package.

Picture a night porter told to let in anyone who says "delivery", without checking the uniform. The only thing the updater checked was the address, and the address had lapsed. Buying it was all it took to become the trusted sender.

What Eye did with the keys

Eye registered one of the abandoned domains and, according to the abstract of its Hack.lu talk, saw millions of unique hardware IDs connect over several months. BleepingComputer reports the connections included corporate, government and military networks, a detail we have not been able to confirm elsewhere.

Rather than leave the door open, Eye used the updater itself to deliver code that switched it off. Eye's write-up says most of the infrastructure is now sinkholed by the Shadowserver Foundation, a non-profit. Android is the exception: the updater cannot be disabled remotely, so those users must remove the app. Everyone should uninstall it, as the software is abandoned and unfixable.

What a defender sees

Very little. An update arriving through a trusted process, running as SYSTEM, looks like routine maintenance. Detection here is mostly inventory. Eye publishes the commands to find and stop the Windows "Update service" and the macOS PT.updd launch daemon, and sweeping for those is quick.

Nothing in the reporting is UK-specific, and that is the point: the updater did not care where its host sat. Any UK organisation with staff who install their own software on work machines had the same exposure as everyone else.

The Secure by Design lesson

Three decisions would have prevented this, and none is expensive:

Sign every update, and verify the signature on the device. Then control of a domain is not control of the machine.
Use encrypted connections to fetch updates. Plain HTTP invites tampering in transit.
Plan for the end of life. Ship a kill switch, or retire the update service when you retire the product.

For a buyer, the cost is a question rather than a purchase: what is running on our estate that nobody owns? Software with no vendor behind it cannot be patched, but it can be found and removed.

Also this week

A patched flaw, still open. Kaspersky reports a UEFI bootkit it calls BlackX, which it attributes with medium confidence to APT41, a state-linked hacking group. It was used against diplomatic agencies in Tajikistan, Uzbekistan and Turkmenistan. It abuses CVE-2022-21894, known as Baton Drop, to get past Secure Boot, the check that stops tampered code loading at startup, and closely resembles the earlier BlackLotus bootkit. The uncomfortable part: Kaspersky says the targeted machines were fully patched. The fix does not take full effect until an administrator manually revokes the old "Windows Production PCA 2011" certificate, and Microsoft's planned automatic enforcement had not arrived at the time of writing. The certificate expiring on 19 October 2026 does not close the hole on its own. The design lesson is that a patch needing a manual second step is a patch many organisations will never finish. If you run Windows estates, check that the revocations were actually applied.

A $25 billion privacy bill. A New Mexico judge, Francis Mathew, has ordered Meta to pay $25 billion in civil penalties over the Cambridge Analytica scandal, after a jury found more than 43 million violations of the state's unfair practices law. Meta says it will appeal, so the figure may fall. It is a US state ruling with no direct force in Britain, but the reasoning travels: the case turned on what the company told users about its data practices. Our view is that UK data protection law rests on a similar idea, that what you say you do with personal data is a promise you can be held to. Read your privacy notice as if a judge will.

Windows Server 2016 runs out of road. Microsoft's lifecycle page lists extended support for Windows Server 2016 ending in January 2027. An unsupported server in a back office is a vulnerability with a date on it, so put the migration in this year's budget, not next year's incident review.

Sources

If you would like a second pair of eyes on what is running across your estate, get in touch.