Eye Security Sends More Than 2 Million Updates to Disable Popcorn Time Updater
Summary
Eye Security says it sent more than 2 million updates from November 2025 to March 2026 to disable Time4Popcorn’s abandoned updater, which could install attacker-supplied code with SYSTEM or root privileges. Other app risks remain.
Key points
- The Time4Popcorn updater, tracked as CVE-2026-30612, checked for updates over an unencrypted connection and installed them with SYSTEM privileges on Windows or root privileges on Mac without verifying the sender.
- Eye Security says it registered abandoned addresses contacted by the updater, creating the possibility that someone controlling them could serve code to computers still checking in.
- Over six months, Eye observed more than 3.8 million hardware IDs, which it said were unreliable for counting devices; its revised estimate was 2.5–3 million Windows computers and 250,000–350,000 Macs.
- Eye says its update only stopped and disabled the updater, without deleting files or collecting data. It reported traffic to its addresses had fallen about 98% by March 1, 2026, and then stopped sending updates.
- Eye found no sign that others were serving code through the addresses it checked. Some addresses it could not take control of remain with outside owners, and the flaw was not listed in CISA’s known exploited vulnerabilities catalog as of October 23, 2026.
- Disabling the updater does not make the app safe: Eye cited its old browser engine, disabled security sandbox, unencrypted content and other abandoned addresses. It recommends uninstalling Popcorn Time; Android users must remove the app to address the updater risk.
Article Details
- Event Type
- Security researchers remotely disabled a vulnerable updater in abandoned Time4Popcorn software by sending it an update.
- Impact
- The updater installed updates without verifying their source and ran with SYSTEM or root privileges, creating the potential for an attacker who registered an abandoned update address to deliver code to affected computers. Eye Security estimated that 2.5–3 million Windows computers and 250,000–350,000 Macs were affected. The article reports no evidence that anyone else used the addresses to serve code. Eye sent more than 2 million disabling updates, then transferred 15 addresses it controlled to the Shadowserver Foundation; other updater addresses remain outside its control. Disabling the updater does not make the app safe, and Eye recommends uninstalling it.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | popcorntimeupd[.]xyz | Abandoned update domain called by the Time4Popcorn updater and identified as part of the takeover risk. Eye Security used controlled update infrastructure to disable the updater; this domain was later transferred to Shadowserver's sinkhole. The article reports no evidence that another party served code through the addresses. |
CVE
Vendors
Products
Industries
Governmentof the connecting addresses, the firm said it saw home users around the world, as well as machines on government, military, and corporate networks, though it added that it is "hard to draw conclusions" from that.Militaryaddresses, the firm said it saw home users around the world, as well as machines on government, military, and corporate networks, though it added that it is "hard to draw conclusions" from that.