Time4Popcorn: abandoned updater with RCE shut down by researchers

Researchers at Eye Security have remotely disabled the update mechanism of Time4Popcorn, an abandoned fork of the Popcorn Time BitTorrent client distributed under the same name. The component, still active on millions of computers, allowed anyone controlling the update domain to run code with the highest system privileges. The vulnerability is tracked as CVE-2026-30612. The story was reported by BleepingComputer (23 October 2026), The Hacker News (24 October) and SecurityWeek (27 October), all based on Eye Security’s research.

The case is a textbook one: there is no vendor to ask for a patch, the software was installed and forgotten, and the fix was delivered by the researchers through the very same flaw.

The flaw: updates over HTTP without signatures

According to BleepingComputer and SecurityWeek, the Time4Popcorn updater for Windows and macOS:

• starts in the background at system boot (SecurityWeek);
• contacts its domains over unencrypted HTTP, including popcorntimeupd.xyz;
• downloads and runs any executable it is given, without checking the digital signature;
• runs it as SYSTEM on Windows and as root on macOS.

Many update domains had been allowed to expire, while others were owned by third parties and parked (SecurityWeek). Whoever registered one of those domains, or could tamper with the HTTP traffic along the path, could therefore deliver an arbitrary “update” and achieve remote code execution with full privileges. The headline of The Hacker News points to the concrete risk: such a large fleet of machines controllable from a single point is ideal material for a botnet.

Relevant MITRE ATT&CK techniques (our classification): T1583.001 (acquiring domains, abandoned ones in this case), T1557 (adversary-in-the-middle on HTTP traffic) and T1195.002 (compromise of software distribution).

How many systems were exposed

After registering popcorntimeupd.xyz, Eye Security saw millions of clients connect. The reported figures:

• Windows: up to 3 million (BleepingComputer), between 2.5 and 3 million (SecurityWeek);
• macOS: up to 350,000, or between 250,000 and 350,000;
• Android: fewer than 200,000 (SecurityWeek only).

Connections came mostly from residential ISPs, but also from corporate, government and military networks around the world. According to BleepingComputer, none of the users appeared to actually use the application, a sign that it had been installed and then forgotten.

How the updater was shut down

Since the project no longer has an owner, Eye Security registered further domains tied to the service: 14 besides the first one according to BleepingComputer, 15 in total according to SecurityWeek, choosing only those not already owned by third parties. Between November 2025 and March 2026 it used the same vulnerable channel to deliver remediation code that stops and disables the updater:

• about 2 million update downloads;
• requests to the domains down by 98% by March 2026;
• according to BleepingComputer, no data collected from the machines, no telemetry, no files deleted; the code was changed during testing because some antivirus products blocked it for disabling a service.

At the end of March the domains were handed over to the Shadowserver Foundation, which keeps them sinkholed together with other abandoned domains from which the application loaded JavaScript code (SecurityWeek).

The remaining risk

The operation only switched off the updater. These points remain open:

1. Android: the update requires user interaction and the updater is part of the app, so it could not be disabled remotely.
2. 2014 browser engine: the application is built on a 2014 version of Chrome, without a sandbox. According to SecurityWeek, Eye Security already has a proof of concept that launches calc.exe via JavaScript.
3. JavaScript domains: they are sinkholed today, but the application is still built to load code from domains the project no longer controls.

Eye Security’s advice, reported by both outlets, is simple: uninstall the application.

Impact for European and Italian companies

The sources give no per-country data, but they confirm that part of the installations sit on corporate networks. The typical issue is shadow IT: software installed by a user years ago, never inventoried, with a component running with system privileges. For NIS2 entities the case directly concerns asset and vulnerability management and control over authorised software. In healthcare and public bodies, shared workstations and personal devices accessing the internal network should be checked first.

What to do now

1. Look for the software: search the Windows and macOS workstation inventory for “Popcorn Time” and “Time4Popcorn”, including services and processes started at boot.
2. Uninstall it, do not just disable the updater: the unsandboxed browser engine remains exploitable.
3. Check DNS and proxy logs for requests to popcorntimeupd.xyz and, more generally, to domains tied to Popcorn Time: they point to a machine where the application is still installed. Block these domains at the perimeter.
4. Android and BYOD: use mobile device management to check whether the app is present and remove it; here the updater is still active.
5. Prevent: use application control or software allowlists to stop the installation of unapproved programs.
6. Widen the check: look for other programs that update over HTTP without signatures or rely on expired domains; the same pattern applies well beyond Popcorn Time.

How ARXDOME helps

ARX Sentry collects the inventory of software, processes and ports from Windows and macOS computers: it helps find the machines where Popcorn Time is still installed. ARX Shield shows the open vulnerabilities per machine and, if a workstation is suspicious, isolates it from the network until it has been checked.

Last updated: 27 October 2026