Researchers at Eye Security found that Time4Popcorn, an abandoned fork of the Popcorn Time BitTorrent streaming app, had an update mechanism anyone could hijack. Tracked as CVE-2026-30612, the Windows and macOS updaters contacted a domain the developers had let lapse (popcorntimeupd.xyz) over unencrypted HTTP and accepted executables without checking digital signatures. Whoever controlled that domain, or could tamper with the traffic, could run code as SYSTEM on Windows and as root on macOS.
Eye registered the domain and saw about 50 requests per second; over six months it counted more than 3.8 million hardware IDs, roughly half on Windows and about 45% on macOS, with the rest on Android. BleepingComputer cites up to 3 million Windows and 350,000 macOS connections, from residential, corporate, government and military networks, and Eye noted that none of the installs appeared to be actively used, just installed and forgotten. Rather than leave the risk open, Eye used the same update path between November 2025 and March 2026 to push a payload that stopped and disabled the updater, collecting no host data and deleting no files. Eye says requests to its domain fell by 98% by March 1, and it handed the domains to the Shadowserver Foundation.
The risk is not fully gone. Eye could not disable the updater on Android, where installing an update needs user action. It also says the app itself is built on a 2014 Chrome engine with the sandbox disabled, loads content over HTTP, and loaded JavaScript from abandoned domains, so its update fix does not make the app safe to keep using. Eye notes its research does not apply to the newer, legal Popcorn Time project that started in 2025.
How to check if you’re affected
Affected products are the Time4Popcorn fork and other unofficial apps distributed under the Popcorn Time name, on Windows, macOS and Android; Eye says it was not always clear to users which version they had installed. Look in your installed applications (and, on Windows, running background processes) for Popcorn Time or Time4Popcorn, particularly on older machines where you may have installed it years ago.
- If you find it, uninstall it. Both Eye and BleepingComputer conclude that removing the software entirely is the safest option, because the updater fix does not cover the rest of the app.
- On Android, remove the app yourself; the updater there could not be disabled remotely.
- On managed networks, check for outbound connections to popcorntimeupd.xyz. The domain is now held by the Shadowserver Foundation, so legitimate traffic there should be gone.