Eye Security disables abandoned Popcorn Time updater (CVE-2026-30612)
According to The Hacker News, Dutch security firm Eye Security pushed more than 2 million updates between November 2025 and March 2026 to switch off the background updater in Time4Popcorn, an abandoned Popcorn Time copy. The updater, tracked as CVE-2026-30612, could have let an outsider take over a machine, and no vendor patch exists.
What we know
Eye Security found the updater during a routine threat hunt, when a program called Updater.exe on a client laptop kept contacting a web address that was no longer registered. The firm registered the address itself and saw about 50 requests a second arrive. It described the effort as Operation IXIM in a write-up and in a Hack.lu talk on October 22, as reported by The Hacker News.
- Over six months the requests carried more than 3.8 million different hardware IDs.
- Because some Windows PCs shared an ID and some Macs changed theirs, Eye revised its estimate to 2.5 to 3 million Windows computers and 250,000 to 350,000 Macs.
- The updater ran at startup on Windows and Mac, checked for new versions over an unencrypted connection, and installed whatever it received at the highest privilege level (SYSTEM on Windows, root on Mac) without verifying the sender.
- Because the update addresses had been abandoned, Eye said anyone who registered the right one could have served their own program to every machine still calling it.
Eye disclosed the flaw in June. The report says CISA rates it 9.8 out of 10. With no company left to fix the software, Eye took legal advice and then served an update that only stops and disables the updater. It deleted no files and collected nothing, according to the report. Eye compared the step to Operation Ladybird in 2021, when Dutch police pushed an update to disable Emotet on infected computers.
Who is affected
Anyone still running Time4Popcorn. The report lists three affected versions:
- Windows: up to and including 6.2.1.18
- Mac: up to and including 6.2.1.17
- Android: up to and including 3.5.0.173
Eye mapped a sample of the connecting addresses and saw home users worldwide, plus machines on government, military and corporate networks, though it said it is “hard to draw conclusions” from that. A separate, legal project that took the Popcorn Time name in early 2025 is unrelated.
Why this matters
This section is our analysis, not new reporting. An updater that installs unsigned code as SYSTEM or root over plain HTTP is effectively a remote code execution service for whoever controls the domain. Eye said an attacker with that access could install ransomware, steal saved passwords or enlist the computer in a botnet. Pirated-media apps are rarely sanctioned on managed devices, so their presence on a corporate network is itself a finding worth chasing. Unmanaged personal devices that connect to corporate resources are the realistic exposure.
What has not been confirmed
- The report does not say that any attacker abused the updater before Eye took control of the address.
- Whether the Android version received the disabling update is not stated in the source material.
- Eye’s machine counts are estimates, and the firm itself says hardware IDs were an unreliable way to count.
What to do
- Search your endpoint inventory and EDR telemetry for Time4Popcorn and for a process named Updater.exe running from a Popcorn Time folder.
- Uninstall Time4Popcorn on every platform. The software is abandoned, so there is no fixed version to move to.
- Do not rely on Eye’s disabling update as a fix. It stops the updater but does not remove the application, and it may not have reached every machine.
- On any machine where the app was present, treat saved browser passwords as potentially exposed if you see unexplained process activity, and rotate them where there is doubt.
- Block or alert on outbound unencrypted update traffic from non-approved software, and review your policy on unmanaged devices that reach corporate systems.
Related free tool: planning network segmentation or access rules for exposed devices? Our Subnet Calculator shows network ranges, masks and usable hosts for any CIDR block.