Abandoned Time4Popcorn updater allowed RCE over plain HTTP
Original title: Abandoned Popcorn Time app exposed millions of device to RCE attacks
Eye Security counted up to 3 million Windows and 350,000 macOS clients calling the domain it registered.
Eye Security registered the abandoned popcorntimeupd.xyz domain used by Time4Popcorn, a Popcorn Time fork. CVE-2026-30612 let whoever controlled that domain send unsigned executables over HTTP and run them as SYSTEM on Windows and root on macOS. From November 2025 to March 2026 the researchers pushed a payload that only stopped and disabled the updater, saw 2 million downloads, and a 98% drop in requests by March 1, then gave the domain to The Shadowserver Foundation. Android clients could not be disabled remotely, and the app still uses a 2014 Chrome engine; Eye says users should uninstall it.
Unconfirmed: No attacker exploitation is reported; Eye only says impact would be severe if others controlled the domain.
- Windows and macOS updaters accepted executables with no digital-signature check.
- Connections included corporate, government, and military networks, but apps looked unused.
- Eye later registered 14 more domains tied to the service.
- By March 1, requests to the update domain had fallen 98%.
- Android installs still need a user to apply an update.
Impact: Remote code execution as SYSTEM on Windows and root on macOS
| Product | Affected |
|---|---|
| Time4Popcorn updater | Windows and macOS updaters contacting popcorntimeupd.xyz |
- 1.Uninstall Time4Popcorn, including copies left installed and unused.
- 2.Treat Android copies as still exposed; the updater was not disabled remotely.
- CVEs
- CVE-2026-30612
- Products
- Time4PopcornPopcorn Time
- Organizations
- Eye SecurityThe Shadowserver Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-30612 | Remote code execution in Time4 Popcorn updater components (Windows, macOS, Android) | 9.8 | <1% |
From the original article
2 min read at bleepingcomputer.com
Researchers remotely disabled a vulnerable updater in the abandoned Time4Popcorn app, a fork of the Popcorn Time BitTorrent client, closing a security flaw that could have allowed attackers to execute malicious code with elevated privileges on millions of computers. [...]
By Bill Toulas · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.