Time4Popcorn CVE-2026-30612: firm disabled updater on 2m PCs

What happens when software is abandoned but keeps running on millions of machines, calling home to web addresses nobody owns any more? Anyone can register those addresses and speak to every device that still asks. That is the lesson of CVE-2026-30612, a critical flaw in Time4Popcorn, and of the unusual way Dutch security firm Eye Security chose to deal with it.

What the Time4Popcorn updater actually is

Time4Popcorn is an abandoned copy of Popcorn Time, a free app that streamed pirated films and TV over BitTorrent. The original shut down in 2014, but several copies kept running under the same name. A separate, legal project that took the Popcorn Time name in early 2025 is unrelated.

The problem sits in a background updater, a small program that checks for new versions and installs them. On Windows it is Updater.exe; on Mac it is a helper called PT.updd. Both start when the computer starts. The flaw is tracked as CVE-2026-30612, and the US Cybersecurity and Infrastructure Security Agency (CISA) rates it 9.8 out of 10.

How it works, and how Eye Security found it

Think of the updater as a letterbox that opens the door to whoever posts something through it, without checking the sender. It asked for new versions over an unencrypted connection and installed whatever came back at the highest privilege level, called SYSTEM on Windows and root on Mac. It never verified who sent the file.

That would be bad enough with live servers. Here the web addresses it called had been abandoned, so anyone who registered the right one could serve their own program to every machine still calling it. An attacker with that access could install ransomware, steal saved passwords or pull the computer into a botnet, a network of hijacked machines run remotely.

Eye Security found it during a routine threat hunt, when Updater.exe on a client's laptop kept trying to reach an unregistered address. The firm registered it to see what would connect. About 50 requests a second arrived. Over six months they carried more than 3.8 million different hardware IDs, which the firm revised to an estimate of 2.5 to 3 million Windows computers and 250,000 to 350,000 Macs. Mapping a sample of connecting addresses, Eye said it saw home users worldwide and machines on government, military and corporate networks, though it added that it is "hard to draw conclusions" from that.

Who acted, and why

Eye had disclosed the flaw in June. With no company left to patch the software, it took legal advice and decided to use the updater against itself. Between November 2025 and March 2026 it pushed an update whose only job was to stop and disable the updater, deleting nothing and collecting nothing. It named the effort Operation IXIM and presented it at Hack.lu on 22 October.

Eye compared it to Operation Ladybird in 2021, when Dutch police pushed an update to Emotet-infected machines. The difference, it said, is that Emotet victims never chose infection, while Popcorn Time users installed the app themselves. Even so, "none of them chose to have a forgotten updater running in the background for years."

The results: more than 1 million systems updated and traffic down about 90 percent by December 2025, then a 98 percent reduction by 1 March, when it was sending about 5,000 updates a day. Judging what remained too small to interest a botnet operator, Eye stopped after more than 2 million update downloads. In late March it handed the 15 domains it controlled to the Shadowserver Foundation, a non-profit that sinkholes abandoned and malicious domains. A transfer for one of them, popcorntimeupd[.]xyz, is dated 20 March 2026.

What the limitations are

The fix is partial. Other addresses the updater calls were never Eye's to take, so machines reaching those remain exposed. Eye found no sign anyone else was serving code through them; those already registered were parked or for sale. CISA's known exploited vulnerabilities catalogue did not list the flaw as of 23 October 2026.

More importantly, the app itself stays dangerous. It runs on a 2014 browser engine with its security sandbox turned off, loads content over unencrypted connections and pulls code from other abandoned addresses. Eye registered those too and built a working proof of concept, so the risk is real. On Android the updater is built into the app and installs only if the user taps to accept, so Eye sent nothing there; removal is the only fix.

Antivirus vendors also complicated the operation. Once the update reached VirusTotal, engines flagged it as malware, which is a fair description of a program that disables a Windows service. Every product that blocked it left the vulnerable updater running, so Eye reworked it until only one scanner still flagged it.

What this means in practice

For UK and US security teams, the exposure includes government and corporate networks, so unmanaged pirate streaming software on a work laptop is a genuine supply-chain and compliance problem. UK organisations holding personal data on affected machines would have to consider their obligations to the ICO; that is a general point, not an action the source reports.

Practical steps:

• Search endpoints for Updater.exe on Windows and PT.updd on Mac, and check network logs for traffic to the 20 domains in Eye's write-up, which also lists file hashes.
• Uninstall Popcorn Time rather than just disabling the updater. Manual disabling is possible on Windows with two commands stopping the "Update service", and on a Mac with one that unloads PT.updd, but it leaves the rest of the app in place.
• Remove it from Android devices; there is no partial option.

Where this is heading

Eye's operation sits in uncomfortable territory: a private firm pushing code to machines it does not own, with legal advice and good intent but no mandate. Expect debate about whether that precedent is welcome, especially as the same trick, registering a dead domain and watching who connects, is available to attackers too. The sturdier lesson is for defenders: inventory the forgotten software calling home from your estate, because an expired domain can turn a dormant updater into someone else's remote control. Related bugs show how little warning such flaws give, as with a Parallels flaw that hands any Mac user root.

Frequently asked questions

Is Time4Popcorn safe to use after Eye Security's update?

No. The update only disabled the updater. The app still runs on a 2014 browser engine with its sandbox off and loads content over unencrypted connections, so uninstalling is advised.

How can an IT team check for the vulnerable updater?

Look for Updater.exe on Windows and PT.updd on Mac, and for traffic to the domains listed in Eye Security's write-up, which includes all 20 domains and file hashes.