Researchers at Eye Security have remotely neutralised a critical Time4Popcorn RCE flaw in the abandoned BitTorrent-based streaming app, after registering the expired update domain and finding up to 3 million Windows machines and 350,000 macOS systems still phoning home to it, as BleepingComputer reports. The vulnerability, tracked as CVE-2026-30612, allowed anyone who controlled that domain to push unsigned executables over plain HTTP and gain SYSTEM-level access on Windows or root on macOS, all without any user interaction.
Connections came from residential ISPs alongside corporate, government, and military networks, though Eye Security noted that none of the users appeared to be actively running the app, it had seemingly been installed and forgotten. As the researchers put it, ‘If we were able to send an update, we could potentially get code execution on millions of systems,’ adding that ‘the impact would be severe if this were to fall into the wrong hands.’
How the vulnerability worked
Time4Popcorn is a fork of the original Popcorn Time client, which offered a Netflix-style interface layered over BitTorrent downloads. The project attracted millions of users before being abandoned. Its updater contacted the now-expired domain popcorntimeupd.xyz over unencrypted HTTP and accepted executables without checking digital signatures, a textbook download-without-integrity-check weakness.
According to the Eye Security Research write-up published in June 2026, on Windows the updater runs as a service called ‘Update Service’, starting an executable typically stored at C:\Program Files (x86)\Popcorn Time\Updater.exe, and launches automatically on system boot. The Rapid7 Vulnerability Database, which catalogued the flaw in August 2026, lists affected versions as Time4Popcorn for Windows up to and including 6.2.1.18, macOS up to 6.2.1.17, and Android up to 3.5.0.173, with a CVSS 3.1 Base Score of 9.8.
After registering the primary update domain, Eye Security went on to register 14 further domains tied to the service, cutting off additional potential attack vectors.
The remediation operation
Between November 2025 and March 2026, Eye Security used the very mechanism that made the app dangerous to fix it, pushing remediation code through the update channel that stopped and disabled the updater service. The payload collected no host data or telemetry and deleted no user files. The team also had to modify the payload during testing to avoid antivirus products that flagged it for disabling a service. By 1 March 2026, requests to Eye Security’s update domain had dropped by 98%, with 2 million update downloads recorded during the operation. Domain ownership was subsequently handed to The Shadowserver Foundation, a non-profit security organisation.
The risk is not fully eliminated, however. Eye Security warns that Android users remain exposed: installing an update on that platform requires user interaction, which prevented researchers from disabling the updater remotely. The app also still ships with a Chrome engine dating from 2014, with no sandbox protections, leaving any remaining installations open to browser-engine exploits. Eye Security’s position is that users should remove the software from their systems entirely.
