Eye Security researchers identified a critical remote code execution vulnerability, CVE-2026-30612, in the discontinued Time4Popcorn application, affecting up to 3.35 million Windows and macOS devices, and successfully deployed a benign payload to disable the threat between November 2025 and March 2026. This action prevented potential attackers from gaining full system control over millions of computers without user interaction, safeguarding personal data and system integrity for users who still had the abandoned software installed.

What the records show

The vulnerability, identified as CVE-2026-30612, existed within the updater component of the Time4Popcorn application, a closed-source fork of the original Popcorn Time BitTorrent client. The insecure updater communicated with its servers over an unencrypted HTTP channel and accepted unsigned executable files for installation. On Windows and macOS systems, this updater ran with elevated privileges, specifically as NT AUTHORITY\SYSTEM on Windows and root on macOS, meaning any malicious code delivered through this channel could execute with full system control without requiring user interaction. For Android devices, the flaw would prompt users to install an attacker-supplied APK file. The CVE record for this vulnerability specifies that it affects Windows versions up to 6.2.1.18, macOS up to 6.2.1.17, and Android up to 3.5.0.173. It is important to note that this vulnerability does not apply to a newer, legitimate project that began using the "Popcorn Time" name in early 2025.

The timeline

Eye Security's investigation began after their analysts observed an Updater.exe process on a client's laptop attempting to connect to the unregistered domain popcorntimeupd.xyz. This domain was part of the application's abandoned update infrastructure. Between November 2025 and March 2026, Eye Security initiated "Operation IXIM". As part of this operation, they registered the popcorntimeupd.xyz domain and 14 other associated domains. The firm's legal team advised on this course of action, drawing parallels to "Operation Ladybird," where Dutch police neutralized Emotet infections.

What changed

By gaining control of the abandoned update domains, Eye Security leveraged the vulnerable update mechanism to deliver a benign payload designed to disable the updater on affected machines. This payload stopped and disabled the "Update service" on Windows systems and disabled the launch daemon responsible for starting PT.updd on macOS. Eye Security affirmed they "collected no telemetry and deleted no files" during this process. The vulnerability had a substantial reach, affecting an estimated 2.5 million to 3 million Windows hosts and 250,000 to 350,000 macOS systems.

What we could not confirm

We could not confirm the specific country of origin for Eye Security, nor the precise number of Time4Popcorn installations still active at the time of the mitigation.