Security firm remotely disables updater for millions of abandoned Popcorn Time installs

Between November 2025 and March 2026, the Dutch security firm Eye Security executed a large-scale remote intervention to neutralize a critical vulnerability in abandoned software. The firm pushed more than two million updates to computers it did not own, targeting a background updater within Time4Popcorn, an unofficial copy of the defunct Popcorn Time streaming application. This operation aimed to prevent malicious actors from hijacking these machines via an unpatched update mechanism.

What happened

Eye Security discovered the vulnerability during a routine threat hunt when analysts noticed a program called Updater.exe on a client laptop attempting to reach an unregistered web address. Upon registering the domain themselves, the team observed approximately 50 requests per second from various devices. Over six months, these requests contained more than 3.8 million unique hardware identifiers. After adjusting for duplicate IDs on Windows PCs and changing IDs on Macs, Eye estimated that between 2.5 and 3 million Windows computers and 250,000 to 350,000 Macs were affected.

The updater ran with high privileges, known as SYSTEM on Windows and root on Mac, and installed any content sent to it over an unencrypted connection without verifying the sender. Because the original domains were abandoned, anyone who registered them could have distributed malware, ransomware, or botnet clients to every connected machine. Eye Security identified affected devices on home networks as well as government, military, and corporate infrastructure, though they noted it is hard to draw conclusions about the specific nature of those enterprise connections.

To mitigate the risk, Eye Security launched Operation IXIM. After seeking legal counsel, they used the vulnerable updater to deliver a patch that simply stopped and disabled the service. They did not delete files or collect user data. By December 2025, they had updated over one million systems, reducing traffic to their controlled addresses by 90 percent. By March 1, 2026, daily updates dropped to around 5,000, a 98 percent reduction. Deeming the remaining footprint too small to attract botnet operators, Eye ceased operations after sending more than two million updates.

How it works

The vulnerability, tracked as CVE-2026-30612, stems from the way the Time4Popcorn updater communicates. It checks for new versions using plain HTTP, meaning the data is not encrypted. More critically, it lacks signature verification, so it accepts and executes any binary delivered to the specified URL. This design allows for a man-in-the-middle attack or, in this case, a domain takeover attack. If an attacker controls the domain the updater queries, they control the code running on the client machine.

Eye Security exploited this same lack of verification to fix the issue. They registered the abandoned domains and served a benign update package. This package contained instructions to stop the "Update service" on Windows and unload the helper on Mac. The process was complicated by antivirus software, which flagged the behavior as malicious because it involved disabling a system service. Eye had to iteratively adjust their update package to bypass detection by all but one scanner, ensuring the patch could actually install and disable the vulnerable component.

Key details

• The vulnerability affects Time4Popcorn versions up to 6.2.1.18 on Windows, 6.2.1.17 on Mac, and 3.5.0.173 on Android.
• CISA rates the severity of CVE-2026-30612 at 9.8 out of 10 due to the ease of exploitation and high privilege access.
• Eye Security transferred control of 15 web addresses to the Shadowserver Foundation in late March 2026 to ensure continued safe handling.
• The update did not fix the main application, which still uses a 2014 browser engine with no security sandbox and loads content over unencrypted connections.
• Android devices were not patched remotely because the updater requires manual user acceptance for installation, unlike the silent background updates on desktop OSes.
• As of October 23, 2026, this flaw is not listed in CISA’s catalog of known exploited vulnerabilities.

Why it matters

This incident highlights the persistent danger of abandoned software supply chains. When a project is discontinued, its infrastructure often decays, leaving open doors for attackers. For developers and IT leaders, this serves as a stark reminder that dependencies and third-party tools must be monitored even after active development stops. The fact that corporate and government networks were among the affected systems shows that unofficial or legacy software can persist in enterprise environments long after it should have been removed.

Furthermore, the ethical and technical complexity of "white hat" remediation is evident. Eye Security had to balance legal risks, antivirus false positives, and the sheer scale of the deployment. Their success relied on the very flaw they were fixing: the lack of verification. In a more secure system, their patch would have been rejected just like any other unauthorized code. This paradox underscores the importance of signed updates and certificate pinning in modern software architecture.

What you can do

• Uninstall Popcorn Time or Time4Popcorn immediately, as disabling the updater does not secure the rest of the application.
• On Windows, manually disable the updater by running sc.exe stop "Update service" followed by sc.exe config "Update service" start= disabled.
• On Mac, unload the helper process by executing launchctl unload -w /Library/LaunchDaemons/PT.updd.plist.
• Scan your network for traffic to the 20 domains listed in Eye Security’s write-up or for the presence of Updater.exe and PT.updd files.
• Review your organization’s software inventory for other abandoned applications that may rely on unverified update mechanisms.
• Ensure all internal and external applications use signed updates and HTTPS with certificate pinning to prevent similar domain takeover attacks.