Abandoned Popcorn Time Updater Exposed Millions to Takeover

Eye Security researchers have disabled the update mechanism of an abandoned Popcorn Time fork and sinkholed its domains, after discovering a vulnerable updater used by Time4Popcorn, a Popcorn Time fork. The updater, which runs at system boot and has no code signing, would download and execute any executable served by the update domain. It connected to the abandoned domain popcorntimeupd[.]xyz and others, exposing millions of devices to potential remote code execution. The flaw is tracked as CVE-2026-30612.

Eye Security reported that the updater was primarily affecting Windows machines (about 2.5–3 million), with macOS systems around 250,000–350,000, and fewer than 200,000 on Android. Connections came from end-user ISPs worldwide, including some government and military networks, as well as corporate networks. Because the updater downloads and runs code with System/root privileges, an attacker could feed a malicious update and take over affected systems.

Since the project had been abandoned, there was no vendor patch, so Eye Security registered 15 domains and pushed a fix that disables the flawed mechanism. By March 2026, roughly 2 million systems had received the update, reducing update requests to its domains by about 98%.

In late March, The Shadowserver Foundation took over the domains, sinkholing the updater infrastructure alongside other related domains used by the Popcorn Time application. The updater can be disabled manually, but the rest of the application remains, and the 2014-era Chrome-based code with no sandboxing means the overall risk persists for remaining users. Eye Security notes that uninstalling Popcorn Time is the safest course.