IT Daily Roundup: October 25, 2026
1. Researchers Disabled the Popcorn Time Updater on Three Million Devices
Dutch security firm Eye Security found that Popcorn Time had a built-in updater that had been contacting abandoned domains for months. The updater downloaded and installed anything from those domains with SYSTEM privileges on Windows and root on macOS, without any signature verification. The flaw is tracked as CVE-2026-30612 with a CVSS score of 9.8. Eye Security registered the domains and, through Operation IXIM, pushed over 2 million updates that disabled the updater only, without touching any other files. The estimated reach was 2.5 to 3 million Windows PCs and 250,000 to 350,000 Macs.
The app itself remains a risk even with the updater off: it runs on an old, unsandboxed browser engine and loads content without encryption. If Popcorn Time is installed on any company device, remove it. On Windows, look for Updater.exe; on macOS, look for PT.updd. Some domains are still controlled by unknown parties, so devices where the updater has not been disabled remain exposed.
Why this matters: Abandoned apps with auto-update functions are a blind spot in most company asset inventories. Popcorn Time rarely went through IT, which is exactly why it tends to show up. Check what is running on company laptops and shared workstations.
2. October 2026: Oracle Releases Over 1,200 Patches, MySQL and Fusion Middleware Take Priority
Oracle published its quarterly security patch set for October 2026. It covers 1,295 fixes for 1,209 unique CVEs, with 95 rated critical. Fusion Middleware received 206 patches, 134 of which are remotely exploitable without authentication. MySQL got 98 patches and Java SE 55. Oracle has not flagged any of the flaws as actively exploited but notes that it regularly receives reports of exploitation attempts against its products.
For most businesses, the most urgent fixes are for MySQL (the database behind web applications and internal tools) and Java SE (the runtime for business and custom software). If you run Oracle E-Business Suite, PeopleSoft, or JD Edwards, those patches need attention too. Oracle's next updates are scheduled for November 17 and December 15.
Why this matters: Patching databases and runtimes is the infrastructure team's job, not the software vendor's. Do you know when your MySQL server was last patched?
3. Attacker Planted Malware in OVHcloud CLI Releases on GitHub
On October 19, an attacker took control of a developer's GitHub account at OVHcloud and modified existing releases of the ovh CLI tool. Versions 0.11.0 through 0.15.0 for macOS, Linux, and Windows contained malware that harvested credentials stored on disk and sent them to attacker-controlled servers. The window of exposure lasted one hour and 34 minutes before a customer flagged the issue and OVH pulled the affected releases. The attack has been attributed to the GlassWorm campaign.
Version 0.16.0 is clean, and OVHcloud has enabled release immutability on GitHub. If you ran any of the affected versions, rotate every credential on that machine: API keys, SSH keys, cloud service tokens, and any other stored secrets. Check your current version with ovh --version.
← All postsWhy this matters: OVH is one of the most widely used hosting providers in Central Europe, and CLI tools for cloud providers typically have access to the full infrastructure. If your DevOps team or server admin uses the ovh CLI, check the version and rotate credentials where needed.