Researchers disable vulnerable updater in abandoned Popcorn Time fork, closing RCE risk on millions of devices

Eye Security registered expired domains, remotely patched systems after finding unencrypted update channel allowed arbitrary code execution at root level

By LineZotpaper AI staff

Published23 October 2026

Updated23 October 2026

Read Time2 min

Sources2 outlets

Security researchers have remotely disabled a critical vulnerability in the abandoned Time4Popcorn application, a fork of the Popcorn Time BitTorrent client, that could have allowed attackers to execute malicious code with elevated privileges on millions of computers. The flaw, tracked as CVE-2026-30612, stemmed from unencrypted HTTP connections to an expired domain and a total lack of digital signature verification on updates.

Researchers at Eye Security discovered that the Time4Popcorn application, a fork of the defunct Popcorn Time media streaming software, was checking for updates over unencrypted HTTP from the domain popcorntimeupd.xyz, a domain that had been abandoned and was available for registration. Anyone controlling that domain could manipulate the update traffic and deliver arbitrary executables, which the updater would install without checking for a valid digital signature. On Windows, this allowed code execution with SYSTEM privileges; on macOS, as root.

After registering the domain, Eye Security observed up to 3 million Windows client connections and 350,000 macOS client connections to the Time4Popcorn update service. Connections came from residential ISPs as well as corporate, government and military networks, although most appeared to be inactive installations that had been forgotten.

“If we were able to send an update, we could potentially get code execution on millions of systems,” Eye Security noted, adding that “the impact would be severe if this were to fall into the wrong hands.”

Between November 2025 and March 2026, the researchers used the vulnerable update mechanism itself to deliver a remediation payload that stopped and disabled the updater. The payload collected no host data or telemetry and did not delete any files. Eye recorded 2 million successful update downloads, and by March 1 requests to its update domain had dropped by 98%. The domain was subsequently transferred to the non-profit security organisation The Shadowserver Foundation.

Despite the successful remediation, the researchers cautioned that Android users remain exposed because installing an update on that platform requires user interaction, and the remote fix could not be applied there. Additionally, the Time4Popcorn app embeds a severely outdated Chrome engine from 2014 with no sandbox protections, which could be exploited in future attacks. The recommended course of action is for users to remove the software entirely.

Analysis

Why This Matters

The vulnerability, if exploited by malicious actors, could have allowed remote code execution with maximum system privileges on millions of devices, including those on corporate, government and military networks.
The case highlights the persistent risk from abandoned or unmaintained software that remains installed on users' systems long after it falls out of active use.
While the immediate threat has been neutralised, Android users and the outdated embedded browser engine still present attack surfaces that cannot be patched remotely.

Background

Popcorn Time was a popular open-source application that provided a Netflix-like interface for streaming video content via BitTorrent. Its original project was abandoned for legal reasons after drawing attention for facilitating access to copyrighted material. Forks of the software, including Time4Popcorn, continued to operate, attracting millions of users. The update infrastructure was left unmaintained, allowing the domain popcorntimeupd.xyz to lapse, which created the security hole that Eye Security exploited for defensive purposes.

Key Perspectives

Eye Security (researchers): The team acted to close a critical vulnerability before it could be weaponised, using the flawed update mechanism itself to deliver a safe fix. Their actions were conducted within legal boundaries, collecting no data and deleting no files.

Users of Time4Popcorn: Many are unaware the software is installed on their systems. While the remote remediation disabled the vulnerable updater, users are still advised to uninstall the app entirely, particularly on Android, where the risk remains.

Broader security community: The incident serves as a reminder of the supply-chain risks posed by abandoned projects, and the value of proactive domain registration and remediation by ethical researchers.

What to Watch

Whether any follow-up research identifies similar risks in other abandoned forks or derivative projects.
Whether The Shadowserver Foundation or other organisations monitor the domain for signs of renewed malicious activity.
Potential disclosure of additional vulnerabilities in the outdated Chrome engine embedded in Time4Popcorn.

Sources

Abandoned Popcorn Time app exposed millions of device to RCE attacks · BleepingComputer
Abandoned Popcorn Time apps had to be disabled to prevent a zombie army · The Verge

Checked

10 claims in this story checked against 1 source: 6 supported.

Show each claim

Partly supportedThe researchers disabled the vulnerable updater, closing the RCE risk on millions of devices.BleepingComputer: “Researchers remotely disabled a vulnerable updater in the abandoned Time4Popcorn app, a fork of the Popcorn Time BitTorrent client, closing a security flaw that could have allowed attackers to execute malicious code with elevated privileges on millions of computers.”
Partly supportedEye Security registered expired domains.BleepingComputer: “Researchers at Eye Security discovered the security risk after registering the popcorntimeupd.xyz domain”
Partly supportedThe vulnerability was critical and could allow malicious code execution with elevated privileges on millions of computers.BleepingComputer: “The vulnerability, tracked as CVE-2026-30612, affects Windows and macOS updaters that contacted the app's abandoned domain (popcorntimeupd.xyz) over unencrypted HTTP and accepted executables without verifying digital signatures. Anyone controlling the update domain could manipulate HTTP traffic and execute code as SYSTEM on Windows and as root on macOS.”
SupportedEye Security said, “If we were able to send an update, we could potentially get code execution on millions of systems.”BleepingComputer: ““If we were able to send an update, we could potentially get code execution on millions of systems,” Eye Securit notes”
SupportedEye Security added, “the impact would be severe if this were to fall into the wrong hands.”BleepingComputer: “adding that “the impact would be severe if this were to fall into the wrong hands.””
SupportedAfter registering the domain, Eye Security observed up to 3 million Windows client connections and 350,000 macOS client connections.BleepingComputer: “Researchers at Eye Security discovered the security risk after registering the popcorntimeupd.xyz domain and observed up to 3 million Windows and 350,000 macOS client connections to Time4Popcorn.”
Partly supportedEye Security recorded 2 million successful update downloads.BleepingComputer: “After deploying the remediation, Eye recorded 2 million update downloads”
SupportedBy March 1, requests to Eye Security’s update domain had dropped by 98%.BleepingComputer: “by March 1 this year, requests to its update domain dropped by 98%.”
SupportedAndroid users remain exposed because installing an update requires user interaction, so the researchers could not disable the updater remotely on that platform.BleepingComputer: “First, Android users remain exposed as installing an update would require user interaction, and researchers could not disable the updater remotely for the mobile platform.”
SupportedTime4Popcorn uses a severely outdated Chrome engine from 2014 with no sandbox protections, which could be exploited in attacks.BleepingComputer: “Second, the Time4Popcorn app uses a severely outdated Chrome engine from 2014, with no sandbox protections, which could be exploited in attacks.”