Popcorn Time flaw triggered 2 million disabling updates
The Popcorn Time flaw tracked as CVE-2026-30612 left millions of computers capable of installing software supplied through abandoned update domains. Between November 2025 and March 2026, Dutch security firm Eye Security sent more than 2 million update downloads to affected machines, using the vulnerable mechanism to stop and disable the updater rather than install a conventional patch.
The updater was part of Time4Popcorn, an abandoned copy of Popcorn Time, an application that streamed pirated films and television through BitTorrent, a peer-to-peer file-sharing system. The original Popcorn Time closed in 2014, but several copies continued operating under the name. A separate legal project that adopted the name in early 2025 is unrelated.
Eye Security encountered the problem during routine threat hunting on a client's network. A program named Updater.exe was repeatedly contacting a web address that was no longer registered. The firm registered the address to observe the traffic and began receiving about 50 requests per second. It later called the work Operation IXIM and described it in a written account and at Hack.lu on October 22.
During six months of observation, requests contained more than 3.8 million different hardware IDs, identifiers intended to distinguish devices. Eye Security found that these were not a dependable measure because some Windows computers shared an ID while some Macs changed theirs. Its revised estimate was 2.5 million to 3 million Windows computers and 250,000 to 350,000 Macs.
On Windows and Mac, the updater started with the computer and continued running in the background. It requested new software through an unencrypted connection, meaning the traffic was not protected against interception, and did not verify who supplied the download. Anything returned could be installed with the operating system's highest level of control, known as SYSTEM on Windows and root on Mac. Because the update addresses had been abandoned, anyone registering the right address could potentially send a program to computers still contacting it.
Eye Security said that level of access could be used to deploy ransomware, steal stored passwords or recruit a computer into a botnet, which is a collection of compromised devices controlled together. A sample of connecting internet addresses included home users worldwide and systems on government, military and corporate networks, although the firm cautioned that firm conclusions could not be drawn from that sample.
The vulnerability was disclosed in June and assigned CVE-2026-30612, a Common Vulnerabilities and Exposures identifier used to track publicly documented security flaws. The U.S. Cybersecurity and Infrastructure Security Agency rates it 9.8 out of 10. Affected releases are Time4Popcorn for Windows through 6.2.1.18, Mac through 6.2.1.17 and Android through 3.5.0.173.
With the software abandoned and no vendor patch expected, Eye Security sought legal advice and created an update that only stopped and disabled the updater. It did not remove files or collect information. The firm compared the intervention with Operation Ladybird, in which Dutch police sent an update to Emotet-infected computers in 2021 to disable that malware. Unlike Emotet victims, Time4Popcorn users had installed the application themselves, but they had not necessarily intended to leave a forgotten updater operating for years.
After someone submitted the defensive update to VirusTotal, antivirus scanners began classifying it as malware because it disabled a Windows service. Each blocked download left the original updater active, so Eye Security revised its program until only one scanner still detected it. By December 2025, more than 1 million systems had received the update and traffic to the controlled addresses had fallen by about 90 percent. By March 1, the firm was delivering about 5,000 updates per day, representing a 98 percent reduction. It then stopped the operation after concluding that the remaining population was unlikely to attract a botnet operator.
In late March, Eye Security transferred the 15 web addresses it controlled to the Shadowserver Foundation. Shadowserver is a non-profit that can hold such addresses as sinkholes, destinations that safely receive unwanted traffic instead of returning malicious content. Public registration information for popcorntimeupd[.]xyz shows a transfer dated March 20, 2026. However, other addresses contacted by the updater remain under outside control, so computers reaching them are still exposed. Eye Security said those already registered by others were parked or offered for sale and showed no evidence of delivering code. As of October 23, 2026, the flaw was not in CISA's catalog of vulnerabilities known to be actively exploited.
Disabling the updater does not make Time4Popcorn safe. According to Eye Security, the application uses a browser engine from 2014 with its sandbox disabled. A sandbox is a restriction intended to prevent web content from controlling the wider computer. The application also loads content without encryption and retrieves code from other abandoned addresses. Eye Security registered those addresses and built a working proof of concept, a demonstration showing that code could be run when the application opened, but it did not deliver that code to users.
Eye Security recommends uninstalling Popcorn Time. Windows users who cannot remove it immediately can stop and disable the service from an administrator command prompt with sc.exe stop "Update service" followed by sc.exe config "Update service" start= disabled. On Mac, the helper can be unloaded with launchctl unload -w /Library/LaunchDaemons/PT.updd.plist. Android's updater is built into the application and requires the user to approve an installation, so Eye Security did not send updates to Android devices. Uninstalling the Android app is the only stated fix.
IT teams can search managed computers for Updater.exe on Windows and PT.updd on Mac. Eye Security's account also lists all 20 contacted domains and file hashes, which are digital fingerprints used to identify exact files. For businesses reviewing this kind of unsupported-software risk, AEU-I offers security-first IT, infrastructure and consulting. The central lesson for affected users is narrower and immediate: remove Time4Popcorn, because disabling one unsafe component does not correct the application's remaining weaknesses.