Eye Security Registers Dead Domains to Push 2 Million+ Updates Disabling Root RCE Updater in Abandoned Time4Popcorn
Eye Security executed a large-scale remediation of an unauthenticated update RCE affecting millions of machines running long-abandoned Popcorn Time forks. The operation reduced inbound traffic 98 percent but exposed how abandoned client software creates durable attack surfaces on both consumer and sensitive networks. Shadowserver now holds the domains.
Handover of the 15 domains to Shadowserver on 1 March 2026 leaves residual traffic at roughly 5,000 daily requests. Remaining instances continue phoning home without authentication, creating a persistent vector for botnet recruitment or ransomware deployment on unpatched hosts that users installed years earlier.
Shadowserver: Inbound requests to the 15 domains fall below 1,000 per day by July 2026 with no new public exploitation reports.
Sources (3)
- [1]Eye Security Operation IXIM Write-up(https://www.eye.security/operation-ixim)
- [2]NVD CVE-2026-30612(https://nvd.nist.gov/vuln/detail/CVE-2026-30612)
- [3]Shadowserver Foundation Handover Notice(https://www.shadowserver.org/news/2026/03/ixim-domains/)