Researchers have remotely disabled a vulnerable updater in the abandoned Time4Popcorn app, a fork of the Popcorn Time BitTorrent client, addressing a flaw that could have allowed attackers to execute malicious code with elevated privileges on millions of Windows and macOS computers. The vulnerability, tracked as CVE-2026-30612, remained exploitable because the updater contacted an abandoned domain over unencrypted HTTP and accepted executable files without verifying their digital signatures.
The vulnerability affected Windows and macOS updaters that connected to popcorntimeupd.xyz. Anyone who gained control of the domain could manipulate update traffic and potentially execute code as SYSTEM on Windows or root on macOS.
Popcorn Time used a Netflix-style interface and integrated BitTorrent downloads, allowing users to consume copyrighted content directly through the application. The original project was canceled for legal reasons but was later relaunched as a legitimate content-streaming app. Forks such as Time4Popcorn continued to use the Popcorn Time name and quickly attracted millions of users.
Eye Security researchers visited the abandoned domain and observed connections from as many as 3 million Windows clients and 350,000 macOS clients using Time4Popcorn.
Source: iSecurity
The connections originated from residential internet providers as well as corporate, government and military networks. However, the researchers said that no users appeared to be actively using the app, suggesting that many installations had been forgotten.
“If you can send an update, your code could potentially run on millions of systems,” Eye Security said, adding, “If this falls into the wrong hands, there will be serious repercussions.”
After discovering the issue, the researchers registered 14 additional domains associated with the service.
Remotely disabling the updater
From November 2025 through March 2026, Eye Security used the vulnerable update mechanism to deliver remediation code that stopped and disabled the updater.
The payloads did not collect data or telemetry from affected hosts, and they did not delete files from users’ computers. The researchers said these measures kept the operation within the bounds of lawfulness.
Eye Security said it had to modify the payload during testing to prevent antivirus products from flagging it because it disabled the service.
After the remediation was deployed, Eye Security recorded 2 million update downloads and observed a 98% reduction in requests to the update domains by March 1.
Once the remediation work was completed, ownership of the domain was transferred to the nonprofit security organization The Shadowserver Foundation.
Users should remove the app
Despite the remediation effort, the researchers warned that risks remain for people who still have the application installed.
Android users remain exposed because installing updates requires user interaction, and researchers cannot remotely disable updaters on mobile platforms.
In addition, Time4Popcorn uses a very old Chrome engine developed in 2014 and lacks sandbox protection, leaving it vulnerable to further attacks.
The researchers’ recommendation is for users to completely remove the software from their systems.
The overall prevention score can hide what happens after the initial access. If an attacker uses valid credentials, your defenses drop sharply.
The Blue Report 2026 measures defense techniques by technology across 338 million simulations run in customer production environments.
Source: www.bleepingcomputer.com