Science & Tech · Cybersecurity · 17 hrs ago
Researchers disable vulnerable Time4Popcorn updaters on millions of devices
Eye Security disabled a vulnerable updater in Time4Popcorn, a fork of the Popcorn Time app that remains installed on devices worldwide.
The Windows and macOS updater contacted an abandoned domain over unencrypted connections and did not check whether software updates were genuine.
Someone taking control of the domain could have installed malicious code with full system privileges, potentially enabling surveillance or a botnet.
Eye Security registered the domain and sent an update that stopped and disabled the updater, without deleting files or collecting device data.
The researchers recorded more than two million update downloads by March 2026 and then transferred the domains they used to the Shadowserver Foundation.
Android devices were not fixed remotely, because installing an update there requires user action.
The app also contains an outdated Chrome engine without sandbox protections, so users are advised to remove Time4Popcorn from their devices.
Researchers at Eye Security used a vulnerable updater in the abandoned Time4Popcorn app to disable it on Windows and macOS devices.
The updater could accept unverified software over unencrypted HTTP, potentially allowing attackers to run code with elevated privileges.
Eye Security observed up to 3 million Windows and 350,000 macOS connections to the updater domain.
The researchers sent more than 2 million remediation updates and said requests to their update domain fell by 98% by March 1, 2026.
Android users remain exposed, and researchers recommend removing the app entirely.
- Who
- Researchers at Eye Security disabled the updater. Time4Popcorn users on Windows and macOS received the remediation.
- What
- The researchers used the vulnerable updater to send code that stopped and disabled it.
- When
- The remediation was carried out between November 2025 and March 2026.
- Where
- The affected devices were around the world and included Windows and macOS systems. Connections came from residential, corporate, government, and military networks.
- Why
- The updater accepted executables without checking digital signatures over unencrypted HTTP, creating a risk of attackers running code with elevated privileges.
This story does not have two clearly opposing sides.
Time4Popcorn remained installed on devices and its updater continued contacting abandoned domains.
Eye Security used the updater to deliver code that stopped and disabled it on Windows and macOS.
Requests to Eye Security’s update domain had dropped by 98%.
Eye Security stopped sending updates and transferred the domains it used to the Shadowserver Foundation.
- Vulnerability
- CVE-2026-30612
- Observed connections
- Up to 3 million Windows and 350,000 macOS clients
- Remediation downloads
- More than 2 million
- Request decline
- 98% by March 1, 2026
- Android status
- The updater was not disabled remotely; installing an update requires user interaction.
3 sources
What people are saying
The update process wasn’t doing anything functional anyway, it was only creating risk for users.
was to do nothing
the impact would be severe if this were to fall into the wrong hands.