Overview
Researchers at Eye Security discovered that the update mechanism of Time4Popcorn, an abandoned fork of Popcorn Time, could be hijacked to run arbitrary code on millions of computers. The flaw is tracked as CVE-2026-30612.
The updater runs at system boot, periodically checks its update servers over plain HTTP, performs no code signing verification, and executes whatever executable the update domain serves, with System or root privileges.
The Lapsed-Domain Problem
Many of the update domains had expired, and others were held by third parties and parked. Anyone who registered or controlled one of them, or who could intercept the unencrypted traffic, could push malicious code to every installed client.
Eye Security registered 15 domains, including popcorntimeupd.xyz. The Shadowserver Foundation later took them over and sinkholed them in late March 2026.
Scale observed
| Platform | Systems connecting |
|---|---|
| Windows | roughly 2.5 to 3 million |
| macOS | roughly 250,000 to 350,000 |
| Android | fewer than 200,000 |
Connections came from ISPs worldwide as well as government, military, and corporate networks.
Remediation
- Eye Security released an update that disables the vulnerable updater. By March 2026 it had reached about 2 million Windows and macOS systems, cutting update requests to its domains by 98%.
- Android requires user interaction to receive the fix, and because the updater is part of the app it cannot be disabled separately.
- The updater can be disabled manually, but the researchers advise uninstalling Popcorn Time entirely. The rest of the app remains vulnerable and is built on a 2014 version of Chrome without a sandbox.
Lessons for Defenders
- Abandoned software with auto-update is a standing remote-code-execution channel once its domains lapse.
- Block or alert on unsanctioned torrent and streaming clients in corporate environments, and review egress to known sinkholed or parked domains.
- Require signed updates over TLS in any software you build or procure.
- Track domain ownership for update and telemetry endpoints you rely on; expiry equals takeover.