Summary
Eye Security says it used the abandoned Time4Popcorn update channel to disable its vulnerable updater on Windows and macOS systems, sending more than 2 million update downloads. The company estimates millions of systems were affected, but says duplicated client IDs make precise counts difficult.
Eye Security says it used the update mechanism in the abandoned Time4Popcorn version of Popcorn Time to disable its vulnerable updater on Windows and macOS computers. The company reports that it sent more than 2 million update downloads between November 2025 and March 2026. The update disabled the updater; it did not repair or remove the main application.
The risk came from an update process that could download and run an executable with high privileges over an unencrypted HTTP connection. Eye says it acted after finding that the software had been abandoned and no vendor patch was forthcoming.
An abandoned updater could run code as SYSTEM or root
Time4Popcorn was one of several forks that used the Popcorn Time name after the original project shut down in 2014. Eye says the fork’s updater continued running in the background on computers where the software had been installed, even when users no longer actively used it. The research concerns Time4Popcorn, not a separate project that began using the Popcorn Time name in 2025.
After reverse-engineering the updater, Eye found that a server response could supply a link to an executable. On Windows, the updater could run that code as NT AUTHORITY\SYSTEM; on macOS, it could run code as root. The process used HTTP and did not check code signatures, according to the company. Eye says the vulnerability was assigned CVE-2026-30612 and that it published an advisory in June 2026.
The scale was difficult to measure. Eye recorded more than 3.8 million hardware IDs over six months, but later found that the IDs did not reliably correspond to unique computers. Cloned Windows installations could share an ID, while changing hostnames could make macOS devices appear to have new ones. Eye estimates it encountered 2.5–3.0 million Windows hosts and 250,000–350,000 macOS hosts.
Eye used the update channel to disable itself
Eye first registered an abandoned update domain and studied the requests made by the software. It tested its disabling update on a small number of systems before expanding deployment. On Windows, the update stopped and disabled the updater service. On macOS, it unloaded the launch daemon that started the updater. Eye says the changes did not collect telemetry or delete files.
The company initially served the update only to IDs it had already observed, then relaxed that restriction to reach more systems. It reports that update requests to its domains fell by 90% after a few weeks. On March 1, 2026, it was still sending about 5,000 updates per day, a 98% reduction in requests. Eye then stopped offering the update and, in late March, transferred the 15 domains it had registered to The Shadowserver Foundation. Some related domains remained owned by other parties.
Eye did not deploy an update to Android devices. In that version, the user must approve installation of an APK, and the updater is part of the main application rather than a separate background service.
Disabling the updater does not make the app safe
Eye’s intervention addressed the updater, not the rest of Time4Popcorn. The company says the main application uses a Chrome engine dating to 2014 with its sandbox disabled, and loads content over unencrypted HTTP, including JavaScript from abandoned domains. Eye says it created a proof of concept that could launch calc.exe through JavaScript in the application.
The company’s advice is to uninstall the old software. Disabling the updater removed one route for remote code execution, but the risks Eye identified in the application itself remain for people who continue to use it.