Time4Popcorn: an abandoned updater left millions of devices wide open

On 23 October 2026, Bleeping Computer reported on an operation by researchers at Eye Security. They remotely disabled the updater in Time4Popcorn, a Popcorn Time fork that its developers had walked away from. The flaw, tracked as CVE-2026-30612, would have let anyone who controlled the update domain run code with SYSTEM privileges on Windows and root on macOS.

Updates accepted, no questions asked

Popcorn Time offered a Netflix-style interface bolted onto BitTorrent downloads, so you could watch illegal content without ever leaving the app. The original project was dropped for legal reasons and later relaunched as a legitimate streaming service. In the meantime, forks like Time4Popcorn had taken over the name, and millions of users came with it.

The vulnerability comes from two flaws stacked on top of each other. The Windows and macOS update modules contacted popcorntimeupd.xyz, a domain left to rot, over unencrypted HTTP. They also ran whatever executables came back without checking a digital signature. Whoever held that domain could tamper with the HTTP traffic and get their own code running with the highest privileges on the machine. Picture a front door with no lock and a doorman who waves in anyone carrying a parcel.

Millions of machines still phoning home

Eye Security spotted the risk after registering the domain itself. Its researchers then saw up to 3 million connections from Windows clients and 350,000 from macOS clients. They came from residential ISPs, but also from corporate, government and military networks.

Yet none of these users seemed to be actively using the app. According to the researchers, it had been installed and then forgotten, but it kept checking in with its update server like clockwork. The team then registered 14 more domains linked to the service.

The flaw ships its own fix

Between November 2025 and March 2026, Eye Security used the vulnerable mechanism to push out remediation code that stopped the update module and then disabled it. The researchers say the code collected no data from the machines, sent no telemetry and deleted no files, so it stayed fully within the law. It had to be reworked during testing because antivirus tools flagged it, precisely because it disabled a service. Security software, it turns out, distrusts anyone who starts switching things off, including the good guys.

The company counted 2 million downloads of the corrective update. By 1 March 2026, requests to its update domain had dropped by 98%. Once the operation was over, ownership of the domain went to the Shadowserver Foundation, a non-profit security organisation.

What’s still exposed

The risk hasn’t fully gone away. On Android, installing an update needs action from the user, so the researchers couldn’t disable the module remotely there. On top of that, Time4Popcorn ships a Chrome engine from 2014: very old, with no sandboxing at all, and another possible way in for an attacker.

The advice couldn’t be clearer: uninstall the software completely. For an IT department, the lesson is that an asset inventory also has to list what nobody uses anymore. A forgotten program keeps its privileges, its outbound connections and its flaws, even if nobody ever opens it.

This time, the people who picked up the abandoned keys were researchers. Nothing in the software’s design guaranteed that the sequel would have such a happy ending.