Abandoned Popcorn Time updater risked takeover of millions of PCs
Original title: Dead Popcorn Time Updater Put Millions of Computers at Risk of Takeover
Eye Security sinkholed updater domains and pushed a disabling update to about 2 million Windows and macOS systems.
Eye Security found that Time4Popcorn, a fork distributed as Popcorn Time, checks abandoned domains over HTTP and runs any executable they supply, without code signing. The flaw is CVE-2026-30612 and could give an attacker System or root privileges. After registering popcorntimeupd.xyz, researchers saw millions of connections, mostly Windows. They registered 15 unowned domains, disabled the updater on roughly 2 million systems, and Shadowserver later sinkholed the domains. Android was not fixed that way, and the 2014 Chrome-based app should be uninstalled.
Unconfirmed: The text does not say criminals exploited the updater; it describes exposure and the researchers’ own proof of concept.
- Observed clients were about 2.5–3 million Windows, 250,000–350,000 macOS, and under 200,000 Android.
- The disabling update cut requests to Eye Security’s domains by 98% by March 2026.
- Connections included government, military, and corporate networks.
- Researchers built a proof of concept that launches calc.exe through JavaScript.
- The updater can be disabled manually, but the rest of the application remains unchanged.
Impact: Remote code execution as System or root via a malicious update
| Product | Affected |
|---|---|
| Time4Popcorn Popcorn Time updater | abandoned fork; application built on a 2014 version of Chrome |
- 1.Uninstall Popcorn Time rather than relying on the updater-only fix.
- 2.Disable the vulnerable updater manually where the application is still installed.
- CVEs
- CVE-2026-30612
- Products
- Popcorn TimeTime4Popcorn
- Organizations
- Eye SecurityThe Shadowserver Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-30612 | Remote code execution in Time4 Popcorn updater components (Windows, macOS, Android) | 9.8 | <1% |
From the original article
2 min read at securityweek.com
Running at system boot, it periodically polled the update domain to execute any code served, with full privileges. The post Dead Popcorn Time Updater Put Millions of Computers at Risk of Takeover appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.