# Abandoned Popcorn Time Fork Exposed Millions of Devices to Remote Attacks

- URL: https://usa-24.com/popcorn-time-vulnerability-time4popcorn/
- Publisher: USA 24
- Section: Cybersecurity
- Published: 2026-10-27T02:25:18.268Z
- Updated: 2026-10-27T02:25:18.293Z
- Topics: Popcorn Time, Time4Popcorn, Remote Code Execution, Software Updates, Consumer Security

> Researchers found an abandoned Popcorn Time fork whose updater could have let attackers run code as SYSTEM or root. The app has no patch, so removal is the only clean fix.

## Key takeaways

- Eye Security found that the abandoned Time4Popcorn updater could have let attackers run code with SYSTEM or root privileges.
- Researchers observed up to 3 million Windows client connections and 350,000 macOS client connections to the updater.
- The flaw, CVE-2026-30612, carries a CVSS score of 9.8 out of 10 in IT-Connect's French-language write-up.
- Eye Security disabled the updater remotely, but Android is not covered by that fix and no patched version exists.
- Uninstalling Time4Popcorn is the only mitigation that removes the risk, because the app has no fixed release.

A Popcorn Time vulnerability could have let strangers run code with the highest privileges on millions of Windows and Mac computers. The flaw sat in the updater of Time4Popcorn, an abandoned, closed-source fork of the BitTorrent streaming app, and many of the machines running it may belong to people who forgot they installed it. Researchers at Eye Security found the problem and have since shut the updater off remotely. The catch is that no patched version exists, so removing the app is the only clean fix.

## What the Time4Popcorn flaw could have allowed

Coverage dated October 23 and 24 laid out the research, and the story was still moving through security news on October 25 and 26. In its report, [BleepingComputer](https://www.bleepingcomputer.com/news/security/abandoned-popcorn-time-app-exposed-millions-of-device-to-rce-attacks/) quoted Eye Security’s researchers: “If we were able to send an update, we could potentially get code execution on millions of systems.” That sentence explains the stakes better than any severity score.

Popcorn Time began as a BitTorrent client with a Netflix-style interface. It became popular about a decade ago, before film-industry legal pressure shut it down, according to [TechRadar](https://www.techradar.com/pro/security/this-abandoned-torrent-app-could-have-exposed-millions-of-devices-to-cyberattack). Because the code was open source, many forks followed. Time4Popcorn was one of them, distributed under the Popcorn Time name but with closed code, so outsiders had to reverse engineer it to see how it behaved.

The privilege level is what makes this serious. On Windows, the attack path ran code as NT AUTHORITY\SYSTEM, the account with near-total control over the machine. On macOS, the equivalent is root. An attacker who controlled the update channel could install whatever they wanted while the app ran with its own trust.

## How the updater could be hijacked

The problem was not a single bug inside the video player. The updater contacted an abandoned domain over unencrypted HTTP and accepted unsigned executables. Anyone who controlled that domain could answer with a malicious file and have it run. [CyberInsider](https://cyberinsider.com/popcorn-time-updater-flaw-exposed-millions-of-devices-to-hijacking/) reported that reverse engineering showed Windows clients would accept a JSON response pointing to an executable, download it and run it as NT AUTHORITY\SYSTEM.

Two design choices made the chain possible. Plain HTTP lets anyone on the network path read or alter traffic. Missing signature checks mean the client never verifies that a file came from the developer. [Mozbot](https://www.mozbot.co.uk/2026/10/24/eye-security-remotely-disabled-time4popcorn-updater-after-discovering-rce-flaw/) described this as a common weakness: updaters that download code without verifying signatures over unencrypted connections.

The abandoned domain made the situation worse. Nobody maintained it, so whoever registered it controlled what every installed copy would fetch. Eye Security registered it first, which turned a potential attack into a defensive opportunity.

## Which versions are affected and how many machines

The affected builds appear in the table below. The CVSS score of 9.8 out of 10 comes from [IT-Connect’s French-language write-up](https://www.it-connect.fr/popcorn-time-updater-cve-2026-30612/), and the reporting reviewed for this story did not include an independent confirmation of that score.

| Platform | Affected Time4Popcorn version | Current status |
|---|---|---|
| Windows | Up to 6.2.1.18 | Updater disabled remotely; uninstall recommended |
| macOS | Up to 6.2.1.17 | Updater disabled remotely; uninstall recommended |
| Android | 3.5.0.173 | Not covered by remote fix; remove manually |

Eye Security observed up to 3 million Windows client connections and 350,000 macOS client connections to Time4Popcorn, according to [BleepingComputer](https://www.bleepingcomputer.com/news/security/abandoned-popcorn-time-app-exposed-millions-of-device-to-rce-attacks/). Those connections came from residential ISPs and from corporate, government and military networks. That mix matters. A forgotten install could be sitting on a work laptop or a government desktop, not just a family PC.

The headline numbers are connection counts, not confirmed installs. CyberInsider reported that over six months the researchers counted more than 3.8 million distinct identifiers, but they could not reliably map those identifiers to individual devices. Nobody knows how many machines still run the app, and that number matters most for cleanup.

## How Eye Security switched off the updater

Eye Security ran a campaign it called Operation IXIM between November 2025 and March 2026. During that period the team recorded more than 2 million update downloads. By March 1, requests to the update domain had dropped 98%, and at one point roughly 50 requests per second were hitting the registered domain.

The researchers registered the abandoned domain and 14 more related domains. They then pushed a remediation payload that disabled the updater remotely. Ownership of the domain later passed to The Shadowserver Foundation, a nonprofit security organization. The researchers say they were able to close the hole legally and keep devices safe, and they report that no threat actor appeared to exploit the flaw before the fix.

Eye compared its move to Operation Ladybird, the Dutch police operation that neutralized the Emotet botnet. The researchers also noted that users had installed this software voluntarily, a distinction that [IT-Connect’s English coverage](https://www.it-connect.tech/popcorn-time-flaw-put-millions-of-pcs-at-risk-cve-2026-30612-explained/) draws in its discussion of the case.

The remote fix is unusual. It worked because the updater trusted a domain that no one maintained, and the researchers were the ones who took it over. It did not uninstall anything. A machine that still has the app keeps the program on disk, and the fix only stops the updater from pulling new code. The sources also do not say whether someone else could re-register the domain after the handover to Shadowserver.

## Whether Popcorn Time is safe to use now

Eye Security says its findings do not apply to a newer project launched under the Popcorn Time name in early 2025. That distinction matters, because the name alone does not tell you which code is running. If you installed something branded Popcorn Time and cannot tell which build it is, treat it as Time4Popcorn until you have checked.

Broader advice holds regardless of which fork you ran. Download software only from its maintainer, and be wary of any app that updates itself over a plain HTTP address. Abandoned projects deserve extra suspicion because nobody is watching their infrastructure.

## How to remove Time4Popcorn on Windows, Mac and Android

Removal is the mitigation that works, since no fixed version exists. The steps below combine the research guidance with standard cleanup practice.

- **Windows:** Uninstall Time4Popcorn from Settings under Apps, and search for both “Popcorn Time” and “Time4Popcorn” in case two copies exist. Then check Task Manager for an Updater.exe process and look for leftover program folders and scheduled tasks. The researchers used the updater’s contact with popcorntimeupd.xyz as the tell, so that domain is a useful search term.
- **macOS:** Move the app from Applications to the Trash, empty the Trash, and check your user Library folders for leftover Popcorn Time files.
- **Android:** Remove the app manually from your device’s app list. Eye Security’s remote fix did not reach Android, and the affected Android build is 3.5.0.173.
- **Work or government devices:** Report any unknown torrent or streaming app to your IT or security team before removing it, so the team can check whether it appeared on other machines. This is general guidance rather than a finding from the research, but it matters here because connections came from corporate and government networks.

## What comes next for abandoned software

Several questions remain open. The reporting reviewed for this story included no CISA advisory, no KEV listing and no FBI or FTC action, so this remains a consumer-security story for now. The device count is unresolved, Android exposure rests on a single source, and it is unclear whether anyone exploited the flaw before March 2026. Eye Security’s full write-up and a CVE.org or NVD record for CVE-2026-30612 would settle several of these points.

Android trust is under scrutiny elsewhere too. A [Microsoft Authenticator flaw](https://usa-24.com/microsoft-authenticator-vulnerability-android/) let Android apps steal work login tokens, a reminder that an installed app can reach data its user never meant to share.

The larger lesson concerns update pipelines. Consumer software often outlives the people who maintained it, and its update channel can outlive them too. Vendors that retire apps should take their update domains offline or hand them to a trusted party, and users should audit the software they forgot they installed.

## Frequently asked questions

### What is CVE-2026-30612?

CVE-2026-30612 is the identifier for a flaw in the updater of Time4Popcorn, an abandoned, closed-source fork of the Popcorn Time BitTorrent client. The updater contacted an abandoned domain over unencrypted HTTP and accepted unsigned executables, which could let an attacker run code with SYSTEM or root privileges. IT-Connect’s French-language write-up gives it a CVSS score of 9.8 out of 10.

### Is Popcorn Time safe to use?

Eye Security says its findings do not apply to a newer project launched under the Popcorn Time name in early 2025. If you have Time4Popcorn installed, or cannot tell which build you have, uninstall it and check for leftover updater processes. Download software only from its maintainer.

### Does the remote fix cover Android?

No. Eye Security’s remote disable did not reach Android, and the affected Android build is 3.5.0.173. Android users should remove the app manually from their device.

### How do I uninstall Time4Popcorn completely?

Uninstall the app through your system’s app settings, then look for leftover Updater.exe processes on Windows or leftover files in your user Library folders on a Mac. Check whether any process contacts popcorntimeupd.xyz. Work and government device users should report the app to IT before removing it.

### Has anyone exploited this flaw?

Researchers say no threat actor appeared to exploit the flaw before the fix. The reporting does not establish whether anyone exploited it before March 2026, so users should not assume their machine was never targeted.

## Sources

1. [Abandoned Popcorn Time app exposed millions of device to RCE attacks — BleepingComputer](https://www.bleepingcomputer.com/news/security/abandoned-popcorn-time-app-exposed-millions-of-device-to-rce-attacks/)
2. [Popcorn Time updater flaw exposed millions of devices to hijacking — CyberInsider](https://cyberinsider.com/popcorn-time-updater-flaw-exposed-millions-of-devices-to-hijacking/)
3. [Abandoned Popcorn Time app exposed millions of device to RCE attacks — OffSeq Radar](https://radar.offseq.com/threat/abandoned-popcorn-time-app-exposed-millions-of-device-to-rce-attacks-d95bc819a3361709)
4. [This abandoned torrent app could have exposed millions of devices to cyberattack — TechRadar](https://www.techradar.com/pro/security/this-abandoned-torrent-app-could-have-exposed-millions-of-devices-to-cyberattack)
5. [Popcorn Time CVE-2026-30612: Millions of PCs Exposed — IT-Connect](https://www.it-connect.tech/popcorn-time-flaw-put-millions-of-pcs-at-risk-cve-2026-30612-explained/)
6. [Eye Security remotely disabled Time4Popcorn updater after discovering RCE flaw — Mozbot](https://www.mozbot.co.uk/2026/10/24/eye-security-remotely-disabled-time4popcorn-updater-after-discovering-rce-flaw/)
7. [Popcorn Time : un processus oublié menaçait des millions de PC (CVE-2026-30612) — IT-Connect (French)](https://www.it-connect.fr/popcorn-time-updater-cve-2026-30612/)