Skip to content
audiotale.net
Sign in
NewsNews

CVE-2026-30612: Popcorn Time (Time4Popcorn) updater runs any code as SYSTEM; uninstall it

Eye Security says millions of machines still run an abandoned Popcorn Time updater with no signing; it disabled the updater on many of them and advises uninstalling the app.

audiotale.net team

· 7 min read

Written by AI from the sources linked below. How we use AI

On this page
  1. Key points
  2. What to do
  3. What happened
  4. Background
  5. How the clean-up worked
  6. The numbers
  7. What it means
  8. What we don't know yet
  9. What to watch next
  10. Sources

Millions of computers still run an update service from the abandoned Popcorn Time fork Time4Popcorn that would download and run any program offered to it, with the highest privileges, over plain HTTP and without code signing. Security firm Eye Security tracked the flaw as CVE-2026-30612, took over some of its abandoned update domains, and between November 2025 and March 2026 pushed its own update that switches the updater off. The company described the whole operation, called IXIM, in a write-up dated 22 October 2026. The application itself remains unsafe, and the advice is to uninstall it.

Key points

  • CVE-2026-30612 is a flaw in the update component of Time4Popcorn, a fork that is also distributed as "Popcorn Time", on Windows, macOS and Android.
  • On Windows and macOS the updater runs in the background and executes whatever it is served as SYSTEM or root; on Android the user is asked to install an APK.
  • No fix exists because the software is abandoned; Eye Security disabled the updater on Windows and macOS machines that contacted its domains and sent more than 2 million update downloads.
  • The firm estimates about 2.5–3.0 million Windows hosts and roughly 250,000–350,000 macOS hosts were affected.
  • The application is still unsafe: it uses a 2014 Chrome engine with its sandbox disabled and loads content over HTTP. Eye Security's advice is to uninstall it.

What to do

Who is affected: anyone who ever installed the Time4Popcorn fork of Popcorn Time on Windows, macOS or Android. Eye Security says the fork often distributes itself simply as "Popcorn Time". A different project that has used the Popcorn Time name since early 2025 to build a legal alternative is not affected.

The fix: there is no patched version. Eye Security recommends removing the software completely.

Check whether you have it:

  • Windows: look for a service called "Update service" and a file Updater.exe in C:\Program Files (x86)\Popcorn Time\ or C:\Program Files\Popcorn Time\.
  • macOS: look for /Library/PrivilegedHelperTools/PT.updd.
  • Android: the updater is part of the app and only checks when you open it.

If you cannot uninstall yet (from Eye Security's June advisory): on Windows, run sc.exe stop "Update service" and then sc.exe config "Update service" start= disabled. On macOS, run launchctl unload -w /Library/LaunchDaemons/PT.updd.plist. On Android the updater cannot be disabled separately, so remove the app. Uninstalling remains the better option, since the application has other weaknesses.

For security teams: Eye Security's write-up lists indicators of compromise and file hashes for Updater.exe and PT.updd so they can be searched for in your environment.

What happened

Eye Security, a managed security provider, noticed during an ordinary threat hunt a process named Updater.exe on a client laptop trying to reach a domain that was no longer registered, popcorntimeupd.xyz. Looking into it, researchers found it belonged to Time4Popcorn, a closed-source fork of Popcorn Time. The firm registered the domain to see what would arrive and, as its write-up says, saw the web server log grow quickly, about 50 requests per second. Each carried an application ID, a hardware ID and version information. Over the following six months it saw more than 3.8 million such IDs, about half on Windows, around 45% on macOS and under 5% on Android.

Reverse engineering showed the updater expected a JSON reply containing a link to an executable. It would download it and run it as NT AUTHORITY\SYSTEM on Windows, with no code signing and over unencrypted HTTP. The macOS version behaved the same way and ran updates as root. On Android the app asks the user before installing an APK. Several of the other domains the updater contacted were registered by third parties, some parked and offered for sale, and many on other platforms were still unregistered.

Background

Popcorn Time was a popular front end for streaming torrents about ten years ago. The original was shut down in 2014 and several forks followed. Eye Security first published an advisory on Time4Popcorn on 11 June 2026, giving the CVE number and the manual steps to disable the updater, and noted that most of the update infrastructure had by then been sinkholed by the Shadowserver Foundation, a non-profit.

The firm says it considered the usual route, telling the vendor, and rejected it: the "vendor" was an anonymous group of forkers who had lost control of the domains and could not have pushed a patch to existing clients anyway. Buying every domain was also not enough, because updates travel over HTTP, so anyone able to tamper with a user's traffic, for example on an open Wi-Fi network, could still hand the updater a program. It also points to past cases in which governments used insecure update channels to install spyware.

How the clean-up worked

Eye Security chose to answer update requests with an update of its own. On Windows it stops the service via the Service Control Manager and sets it to disabled, nothing more: no telemetry and no file deletion. On macOS a shell script runs the launchctl unload command above. It compared its approach to Operation Ladybird, in which Dutch police used an update to neutralise Emotet infections, while noting that the Popcorn Time users had installed their software voluntarily. It says it did not deploy anything to Android, where installing would need user action and the updater is inside the main app.

To limit the risk that others would copy the technique, the firm initially served the update only to hardware IDs it had already seen, once each, and redirected clients to HTTPS where possible. After a few weeks it relaxed those limits. It also had to deal with antivirus products: after someone uploaded the update to VirusTotal, 11 vendors flagged it within a week as malicious, which left those machines with the vulnerable updater running. The firm adjusted its code until only one vendor flagged it.

The Verge, which covered the story on 23 October, notes the ethical concerns and quotes the researchers saying their only alternative was to do nothing.

Drop in update requests reaching Eye Security's domains%
Drop in update requests reaching Eye Security's domains (%)
%
After a few weeks (Dec 2025)90
1 March 202698

Source: Eye Security, Operation IXIM (22 October 2026)

The numbers

Counting machines was harder than it looked. Eye Security's raw count was 3.8 million hardware IDs, but it found the figures unreliable in both directions. On Windows, a bug in the ID generation means the machine GUID is almost never mixed into the hash, so cloned system images, such as the standard image HP uses on EliteBook and ProBook G9 laptops, share one ID. The firm therefore estimates 2.5–3.0 million Windows hosts, more than the raw count suggested. On macOS, IDs change when a hostname or network address changes, inflating the count; the initial estimate of 1.7 million macOS hosts is probably closer to 250,000–350,000.

By December 2025, about a month in, the update had reached more than a million systems and requests had dropped 90%. On 1 March 2026 about 5,000 updates a day were still being sent, a 98% reduction, at which point the firm stopped. Total updates sent exceeded 2 million downloads. In late March it transferred the 15 domains it owned to the Shadowserver Foundation; some domains are still owned by third parties.

What it means

For users: disabling the updater does not make Popcorn Time safe. Eye Security says the app is built on a 2014 Chrome engine with the sandbox disabled, uses unencrypted HTTP and loaded JavaScript from abandoned domains, which the firm also registered and later transferred. It built a proof of concept that runs calc.exe through that JavaScript.

For companies: the connections came from home internet providers but also, the firm says, from corporate, government and military networks. Forgotten software that runs a background updater is an inventory problem, and an abandoned updater is effectively a remote-execution hole waiting for a domain to lapse.

For the industry: the case reopens the argument over researchers taking active measures on machines they do not own. The firm says its legal team advised it and that it limited its change to turning off one service; others may judge the trade-off differently.

What we don't know yet

  • The exact number of devices at risk; Eye Security itself calls its counts estimates.
  • How many machines still run the updater, particularly those behind security products that blocked the disabling update, and the Android installs it did not touch.
  • Whether any third party that owns one of the remaining domains has served updates.
  • Whether any regulator or law-enforcement body has views on the clean-up.

What to watch next

  • Further talks from the researchers; a Hack.lu 2026 session by Eye Security's Niels Teusink covers the same events.
  • Whether other abandoned software with unregistered update domains is found.
  • Security vendors updating detections so that the disabling update stops being flagged.

Sources

SaveStart the discussion

Written by

audiotale.net team

The official account of the people who run audiotale.net: announcements, conversation starters and the newsroom's drafts. Posts written with AI say so. Every other account here is a real person.

Read next